Skip to content

Commit 395efde

Browse files
proddataproddata
authored
Add Access Management page (#89)
1 parent fe8d733 commit 395efde

File tree

2 files changed

+150
-0
lines changed

2 files changed

+150
-0
lines changed

‎docs/index.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,7 @@ Export <cluster/export>
153153
Backups <cluster/backups>
154154
Manage Cluster <cluster/manage>
155155
Billing <organization/billing>
156+
Access Management <organization/access-management>
156157
API <organization/api>
157158
How Tos <howtos/index>
158159
Croud CLI <tutorials/deploy/croud>

‎docs/organization/access-management.md‎

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
# Access Management
2+
3+
CrateDB Cloud manages user access at two levels: through the Cloud Console and
4+
directly within the database. Cloud Console access is handled via the CrateDB
5+
Cloud user interface, where users are granted access to manage and monitor their
6+
deployments. Database access is controlled using database-specific user accounts
7+
and roles.
8+
9+
## Authentication Options
10+
11+
CrateDB Cloud offers multiple authentication methods. This guide outlines best
12+
practices for configuring authentication securely. Always consult your security
13+
team before choosing an authentication method.
14+
15+
### Email + Password
16+
CrateDB Cloud supports authentication via email and password. To ensure the
17+
security of your account, follow these best practices:
18+
19+
- Use a strong, unique password. Online resources can help you create memorable
20+
yet secure passwords.
21+
- Alternatively, generate a random password using a password manager for
22+
enhanced security and easy storage.
23+
24+
### SSO with Google, Microsoft, or GitHub Social
25+
CrateDB Cloud supports single sign-on (SSO) via Google, Microsoft, or GitHub.
26+
Here's how to get started:
27+
1. Sign up for CrateDB Cloud using your company Google, Microsoft or GitHub account.
28+
2. Invite other users using their company email addressess.
29+
30+
For organizations using Google or Microsoft SSO, this setup ensures users
31+
authenticate through the organization's login process — either via your identity
32+
provider or directly through Google or Microsoft authentication — before accessing
33+
CrateDB Cloud.
34+
35+
:::{note}
36+
When signing in with an external authentication provider for the first time, a
37+
CrateDB Cloud user account will be automatically generated for you.
38+
:::
39+
40+
:::{note}
41+
When using Google, Microsoft, or GitHub for authentication in CrateDB Cloud,
42+
admin permissions might be required to configure and allow access, depending
43+
on your organization's settings.
44+
45+
For **Microsoft**, admins may need to:
46+
- Grant tenant-wide consent for the permissions requested by CrateDB Cloud
47+
(`openid`, `profile`, `email`, and `offline_access`).
48+
- Allowlist the CrateDB Cloud application if app registrations or third-party
49+
integrations are restricted.
50+
51+
For **Google**, admins might need to:
52+
- Authorize the CrateDB Cloud application in the Google Admin Console under
53+
"Apps > App Management".
54+
- Enable external applications if they are restricted within your organization.
55+
56+
For **GitHub**, admins may need to:
57+
- Approve the CrateDB Cloud application in the GitHub organization settings
58+
under "Third-party access".
59+
60+
Consult your admin team to ensure proper setup for CrateDB Cloud authentication.
61+
:::
62+
63+
### Limitations
64+
- Currently, each authentication method creates a separate CrateDB Cloud account.
65+
It is not possible to switch between authentication methods for the same
66+
account at this time.
67+
- Authentication using Google, Microsoft, or GitHub relies is implemented via
68+
OpenID Connect (OIDC) but does not support full SAML-based integration.
69+
70+
71+
---
72+
73+
## User Roles and Privileges
74+
75+
This section provides details on user roles and privileges in CrateDB Cloud,
76+
covering both organization roles for Cloud users and database-specific roles.
77+
78+
### CrateDB Cloud Organization Roles
79+
80+
In CrateDB Cloud, users are assigned **organization roles** to manage access to
81+
Cloud resources.
82+
83+
- **Organization Admin**:
84+
- Can add, edit, or remove users within the organization.
85+
- Can perform all available operations on clusters and services.
86+
- Can manage billing and subscription details.
87+
- Must always exist; at least one admin is required per organization.
88+
89+
- **Organization Member**:
90+
- Grants no permissions and only indicates membership in the organization.
91+
- Cannot add, edit, or remove resources or perform administrative tasks.
92+
- Primarily used to invite new users to the organization.
93+
94+
95+
### Database Users and Roles
96+
97+
CrateDB Cloud automatically creates several system and administrative accounts
98+
during cluster setup. These accounts serve specific purposes and should not be
99+
modified or deleted to ensure proper cluster functionality.
100+
101+
- **`admin`**
102+
- **Purpose**: Created when deploying a new cluster, this user is intended
103+
for CrateDB Cloud users to manage the database.
104+
- **Permissions**: Full privileges, allowing execution of all database
105+
operations.
106+
- **Usage**:
107+
- The password for the `admin` user is displayed after the initial cluster
108+
deployment.
109+
- The password can be changed later through the **Cluster Management** page
110+
in the Cloud Console.
111+
- The `admin` user is also the default account used by the **Cloud SQL
112+
Console**.
113+
114+
- **`system`**
115+
- **Purpose**: Manages backend operations such as cluster upgrades, backups, and scaling.
116+
- **Permissions**: Full admin privileges, allowing execution of all database operations.
117+
118+
:::{note}
119+
The `system` user is essential for CrateDB Cloud to operate correctly. Editing
120+
or deleting this user could result in system malfunctions and compromise
121+
cluster functionality.
122+
:::
123+
124+
- **`gc_admin`**
125+
- **Purpose**: Handles automations, such as scheduled jobs and table policy
126+
management.
127+
- **Permissions**: Full admin privileges, allowing execution of all database
128+
operations.
129+
130+
:::{note}
131+
The `gc_admin` user is crucial for maintaining cluster automation processes.
132+
Editing or deleting this user could disrupt scheduled jobs, table policies,
133+
and other automated workflows.
134+
:::
135+
136+
- **`crate`**
137+
- **Purpose**: Acts as the default superuser for the cluster.
138+
- **Permissions**: Full privileges, allowing execution of all database
139+
operations.
140+
- **Restrictions**:
141+
- Authentication is limited to `localhost` for security.
142+
- Additional superusers cannot be created.
143+
144+
---
145+
146+
For more details on CrateDB user management and privileges, refer to the
147+
CrateDB documentation on {ref}`user management <crate-reference:administration_user_management>`
148+
and {ref}`privileges. <crate-reference:administration-privileges>`
149+

0 commit comments

Comments
 (0)