Configure RBAC on OCP

Edit online

Learn how to enable and configure Role Based Access Control (RBAC) in IBM Application Modernization Accelerator on OpenShift Container Platform, including identity provider setup and role mapping.

Before you begin

Note: RBAC is available in Application Modernization Accelerator version 5.0.0 and later. This feature is not available in earlier versions.

Before you begin, ensure you have:

  • Administrator access to the OpenShift Container Platform cluster
  • IBM Application Modernization Accelerator (AMA) operator installed
  • Access to the OpenShift web console

About this task

Note: By default, RBAC is disabled after an install.

Procedure

  1. Enable RBAC in the AMA operator.
    1. Go to Installed Operators and click the IBM Application Modernization Accelerator (AMA) operator.
    2. Click Application Modernization Accelerator.
    3. Under AppMods click ama.
    4. Click on yaml.
    5. Do a search for RBAC.
    6. Change rbacEnabled: false to rbacEnabled: true.
    7. If you need audit enabled, change amaAuditEnabled: false to amaAuditEnabled: true.
    8. Save the yaml.
      The configuration changes are applied and the server pod begins restarting.
  2. Verify the server pod has restarted.
    1. Navigate to Workloads → Pods.
    2. Wait for the server pod to complete the restart process.
      The server pod status shows as Running with all containers ready.
  3. Configure a provider so users can login.
    For example, on OpenShift you can do this with the htpasswd identity provider. See Configuring an htpasswd identity provider.
    Users can now authenticate using the configured identity provider.
  4. Create reader and writer groups.
    Once the users are created with the provider, create reader and writer groups using the following commands:
    oc adm groups new Reader
oc adm groups new Writer
    Two new groups (Reader and Writer) are created in OpenShift.
  5. Assign users to those groups.
    Use the following commands to add users to the appropriate groups:
    oc adm groups add-users Reader user1
oc adm groups add-users Writer user1
    Users are assigned to their respective groups and can access Application Modernization Accelerator with the appropriate permissions.

What to do next

Mapping the initial Admin role

Once RBAC has been enabled, the next user to access the UI will be redirected to the RBAC access screen.

This user will be presented with a list of OAuth2 groups that they belong to and MUST select one of those groups to be mapped to the AMA admin role.

Important: This mapping cannot be deleted.

Mapping roles in AMA

The Admin user can map roles and workspaces in Application Modernization Accelerator:

  1. Choose the Roles and permissions option in the left hand menu.
  2. When creating a mapping, enter the OAuth2 group you want to map and select the AMA role you want to map to.
Note: The OAuth2 group text is not validated by AMA.
Tip: The OAuth2 group can be defined using regex syntax. For example, an OAuth2 group defined as Dev* will match any OAuth2 group starting with Dev.