You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The Folders Storage section of DIAL Admin lets you control which users or roles can browse and access different directories in the [Assets (Prompts & Files) area](/docs/tutorials/3.admin/assets-files.md). On this screen, you can define per-folder Access Control Lists (ACLs) rules.
5
+
Folders Storage displays the current structure and content of the **Public**folder of the DIAL file storage.
6
6
7
-
## Folders List
7
+
> Refer to [Access Control](/docs/platform/3.core/2.access-control-intro.md) to learn more about Private and Public logical spaces for objects storage in DIAL.
8
8
9
-
The **Folders Storage** section is where you manage all folders and their hierarchy.
9
+
## Folders
10
10
11
-
11
+
Objects ([applications](/docs/tutorials/3.admin/assets-applications.md), [files](/docs/tutorials/3.admin/assets-files.md), [prompts](/docs/tutorials/3.admin/assets-prompts.md), [toolsets](/docs/tutorials/3.admin/assets-toolsets.md)) get to the Public folder when published by end users or added by administrators.
12
12
13
-
### Folders Hierarchy
13
+
> Refer to [Chat User Guide](/docs/tutorials/0.user-guide.md#publish-2) to learn how end users can publish applications and to [DIAL Core API Publications](https://dialx.ai/dial_api#tag/Publications) to learn how to create and manage publication requests via API.
14
14
15
-
**Folders Structure (Left Pane)**: Shows a hierarchical view of all storage folders under the root.
15
+
**Note**: Public folder does not contain private objects of DIAL users!
|**Public folder**| A root folder accessible to all users. |
20
-
|**User-defined folders**| Collapsible folders you create to group files by project, team, domain, or environment. |
17
+
Objects in the Public folder are arranged hierarchically, similar to a file system.
21
18
22
-
### Folders Permissions
19
+
-**Root folder**: Pubic is a root folder which can include sub-folders and files.
20
+
-**Sub-folders**: Sub-folders can include uploaded files and files of published applications.
23
21
24
-
When a folder is selected, the right pane displays its access-control rules which determine who can view or add assets in the selected folder.
22
+
25
23
26
-
Rules can be nested under **And/Or** blocks to form complex access policies:
27
-
***And**: All rules must be satisfied.
28
-
***Or**: At least one rule must be satisfied.
24
+
## Access Rules
25
+
26
+
Click any folder to display its access rules.
27
+
28
+
***Public folder**: Access to the root Public folder is predefined and available to all authorized DIAL users.
29
+
***Sub-folders**: Sub-folders within the Public folder can have custom access rules defined by administrators or by users in publication requests. The effective authorization rule for an object in a sub-folder includes restrictions applied to all parent sub-folders up to the root folder. Refer to [Tutorials](/docs/tutorials/1.developers/1.work-with-resources/0.work-with-publications.md#effective-rules) to learn about affective rules for folders.
30
+
31
+
> Refer to [Access Control](/docs/platform/3.core/2.access-control-intro.md) to learn more about Private and Public logical spaces for objects storage in DIAL.
32
+
33
+
34
+
29
35
30
-
> **Note**: If a folder has a parent folder, all access rules of a parent folder also apply to the child folder.
36
+
##### Working with access rules
31
37
32
-
38
+
To determine whether a logged-in user has access to a particular resource in sub-folders, DIAL Core matches `claims` from identity providers (IDPs) with access rules.
33
39
34
-
##### Adding & Removing Access Rules
40
+
> * Refer to [JWT](/docs/tutorials/2.devops/2.auth-and-access-control/1.jwt.md) and [API Keys](/docs/tutorials/2.devops/2.auth-and-access-control/0.api-keys.md) to learn how to enables access to DIAL resources.
41
+
> * Refer to [Tutorials](/docs/tutorials/2.devops/2.auth-and-access-control/2.configure-idps/0.overview.md) to discover configurations for supported identity service providers.
35
42
36
-
1. Click **Add** to append a new permission rule to the selected folder.
37
-
2. Specify attribute, operation and value.
43
+
Access rules for objects in sub-folders can be defined using three parameters:
44
+
45
+
***Attribute**: Specific `claim` in JWT token payload. E.g: role.
46
+
***Value**: Array of claim `values`. E.g.: admin.
47
+
***Operation**: Matching functions for `claims` and `values`. E.g: Equal.
48
+
49
+
50
+
51
+
Rules can be nested under **And/Or** blocks to form complex access policies:
52
+
53
+
***And**: All rules must be satisfied.
54
+
***Or**: At least one rule must be satisfied.
38
55
39
-
Click the trash-can icon on the right edge of any rule to remove it.
56
+
> **Note**: If a folder has a parent folder, all access rules of a parent folder also apply to the child folder. Refer to [Tutorials](/docs/tutorials/1.developers/1.work-with-resources/0.work-with-publications.md#effective-rules) to learn about affective rules for folders.
Copy file name to clipboardExpand all lines: docs/tutorials/3.admin/access-management-keys.md
+74-72Lines changed: 74 additions & 72 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,122 +4,131 @@
4
4
5
5
DIAL Core uses API keys to manage access of external applications for resources in DIAL.
6
6
7
+
> * Refer to [DIAL Core](https://github.com/epam/ai-dial-core/blob/development/docs/dynamic-settings/keys.md) to learn how API keys are defined in DIAL Core configuration.
7
8
> * Refer to [Access Control](/docs/platform/3.core/2.access-control-intro.md) to learn more about access control in DIAL.
8
9
> * Refer to [Tutorials](/docs/tutorials/2.devops/2.auth-and-access-control/0.api-keys.md) to learn how to configure access and usage control for API keys.
9
10
10
11
## Main Screen
11
12
12
-
On the main screen you can see all existing API keys with their details.
13
+
On this screen, you can find all API keys defined in your instance of DIAL. Here, you can also add and manage API keys.
14
+
15
+
> API keys can also be defined directly in [DIAL Core configuration](https://github.com/epam/ai-dial-core/blob/development/docs/dynamic-settings/keys.md).
13
16
14
17
15
18
16
-
##### Keys Grid
19
+
##### Keys grid
17
20
18
21
> **TIP**: Use the **Columns** selector to customize which columns are visible in the grid.
|**Status**| Current validity status of the key. A key is **invalid** in cases when there are no roles assigned to it, or its secret value is missing or is expired. |
33
+
|**Project**| Name of the project the key was created for. |
34
+
|**Project contact point**| Email of the responsible person or group. |
35
+
|**Secured**| Indication if it is [secured API key](/docs/platform/3.core/4.privacy.md#applications-audit-logs). |
36
+
|**Topics**| Tags assigned to the key (e.g. "admin", "user"). |
35
37
36
38
## Create Keys
37
39
38
40
Follow these steps to create a new API key:
39
41
40
-
1. Click **Create** to invoke the **Create Key** modal.
42
+
1. Click **Create** to invoke the **Key** modal.
41
43
2. In the modal, specify the following parameters for the new key:
42
44
43
-
| Field | Required | Description|
44
-
|---------------------|----------|-------------|
45
-
|**ID**| Yes | A unique key under the Keys section of DIAL Admin. Click Generate to automatically create unique GUID.|
46
-
|**Display Name**| Yes | A user-friendly name of the Key. |
47
-
|**Description**| No | An optional free-form text.<br />Use to document the key’s purpose, owner team, or usage context. |
48
-
|**Project**| Yes | Logical project or department grouping (e.g. "AnalyticsTeam").<br />Helps organize keys and apply cost/usage reporting by project. |
49
-
|**Key value**| Yes | The actual secret string used for authentication.<br />Initially hidden; click **👁️** to reveal.<br />Press **Generate** to have its value automatically generated in GUID format. |
50
-
|**Validity Period**| Yes | A key's expiration time period. Use to enforce credential rotation and retirement.|
|**Display Name**| Yes | Name of the key displayed on UI.|
49
+
|**Description**| No | Description of the key.|
50
+
|**Project**| Yes | Name of the project the key was created for. |
51
+
|**Key value**| Yes | Secret string used for authentication.<br />Initially hidden; click **👁️** to reveal.<br />Press **Generate** to have its value automatically generated in GUID format.<br />Can be changed in [Properties](#properties). |
52
+
|**Validity Period**| Yes | Key's expiration time period. Use to enforce credential rotation and retirement. |
51
53
52
-
3. Once all required fields are filled, click **Create**. The dialog closes and the new [key configuration](#key-configuration) screen is opened. A new key entry will appear immediately in the listing once created.
54
+
3. Once all required fields are filled, click **Create**. The dialog closes and the new [key configuration](#configuration) screen is opened. A new key entry will appear immediately in the listing once created.
53
55
54
56
55
57
58
+
## Delete
56
59
57
-
## Key Configuration
60
+
Click **Delete** on the main screen to permanently remove the selected key.
61
+
62
+
> **Note**: All related entities (applications, models, routes) bound to the deleted API key will fail.
63
+
64
+
65
+
66
+
## Configuration
58
67
59
68
Click any API key to display the configuration screen.
60
69
61
70
### Keys Rotation
62
71
63
72
Use **Rotation** to refresh an existing API key.
64
73
74
+
> Note, that after rotation the key's generation timestamp will be updated accordingly.
75
+
65
76
1. Click any API key to invoke the configuration screen
66
77
2. Click **Rotate**.
67
78
3. Paste or auto-generate a new secret in the **Key value** field.
68
79
4. Pick the **Validity period**. The default expiration period is three months.
69
80
5. Click **Rotate** to apply the changes.
70
81
82
+
83
+
71
84
### Properties
72
85
73
86
In the Properties tab, you can view metadata and manage the selected settings for a specific API key.
|**ID**| - | A unique key under the Keys section of DIAL Admin. |
80
-
|**Creation Time**| - | Date and time when the key artefact was created in DIAL. |
81
-
|**Key Generation Time**| - | Date and time when the actual key value was last modified. |
82
-
|**Expiration Time**| - | Date and time when the key is expiring. |
83
-
|**Status**| - | Indicates the validity status of a key.<br /> A key is **invalid** in cases when there are no roles assigned to it, or its secret value is missing or is expired.|
84
-
|**Display Name**| Yes | A user-friendly identifier of a key.<br />Use meaningful names to tie keys back to projects, environments, or teams. |
85
-
|**Description**| No | A free-form text.<br />Use to document the key’s purpose, owner team, or usage context (e.g. "Used by QH Data Ingestion pipeline"). |
86
-
|**Project**| Yes | Logical project or department grouping (e.g. "QH", "AnalyticsTeam").<br />Helps organize keys and apply cost/usage reporting by project. |
87
-
|**Project contact point**| No | Email of the responsible person or group. |
88
-
|**Key value**| Yes | The actual secret string used for authentication.<br />Initially hidden - click **👁️** to reveal.<br />Press **Copy** to copy it to clipboard. |
89
-
|**Secured**| Yes | Toggle to make the key a [secured API key](/docs/platform/3.core/4.privacy.md#applications-audit-logs). |
90
-
|**Topics**| No | Tags that you can assign to keys (e.g. "admin", "user"). Helps to split keys into categories for better navigation on UI. |
88
+
| Field | Required | Description |
89
+
|-------|----------|-------------|
90
+
|**ID**| - | Unique key identifier. |
91
+
|**Updated Time**| - | Timestamp of the last update. |
|**Status**| - | Current validity status of the key. A key is **invalid** in cases when there are no roles assigned to it, or its secret value is missing or is expired. |
96
+
|**Display Name**| Yes | Name of the key displayed on UI. |
97
+
|**Description**| No | Description of the key. |
98
+
|**Project**| Yes | Name of the project the key was created for. |
99
+
|**Project contact point**| No | Email of the responsible person or group. |
100
+
|**Key value**| Yes | Secret string used for authentication.<br />Initially hidden - click **👁️** to reveal.<br />Press **Copy** to copy it to clipboard. |
101
+
|**Secured**| Yes | Indication if it is [secured API key](/docs/platform/3.core/4.privacy.md#applications-audit-logs). |
102
+
|**Topics**| No | Tags assigned to the key (e.g. "admin", "user"). |
103
+
104
+
91
105
92
106
### Roles
93
107
94
108
API keys must be associated with a specific role in DIAL Core to be valid. Roles give access to specific DIAL resources and can impose usage and cost limits.
95
109
96
110
In the Roles tab, you can associate the selected API key with existing [roles](/docs/tutorials/3.admin/access-management-roles.md).
|**Description**| User-friendly summary of the Role’s purpose. |
104
-
105
-
#### Add
112
+
106
113
107
-
To associate one or more roles with the selected API key:
114
+
| Column | Description |
115
+
|--------|-------------|
116
+
|**Display Name**| Role's name displayed on UI. |
117
+
|**Description**| Description of a role. |
118
+
|**ID**| Unique role's identifier. |
108
119
109
-
1. Click **+ Add** (top-right of the Roles Grid).
110
-
2.**Select** one or more roles in the modal window. Roles are defined in the [Access Management → Roles](/docs/tutorials/3.admin/access-management-roles.md) section.
111
-
3.**Confirm** to insert them into the table.
120
+
##### Available actions
112
121
113
-
#### Remove
122
+
| Action | Description |
123
+
|--------|-------------|
124
+
| Add | Use to a role that will get access to the selected API key. |
125
+
| Remove | Use to disconnect the selected role from API keys. To delete role, go to [Roles](/docs/tutorials/3.admin/access-management-roles.md). |
114
126
115
-
Use to stop associating API keys with roles.
116
-
117
-
1. Click the **actions** menu in the role's line.
118
-
2. Choose **Remove** in the menu.
127
+
### Audit
119
128
120
-
129
+
The Activities section provides detailed visibility into all changes made to the selected API key. This section mimics the functionality available in the global [Audit → Activities](/docs/tutorials/3.admin/telemetry-activity-audit.md) menu, but is scoped specifically to the selected API key.
121
130
122
-
> To delete a role, go to the [Access Management → Roles](/docs/tutorials/3.admin/access-management-roles.md) section.
131
+
123
132
124
133
### JSON Editor
125
134
@@ -129,18 +138,11 @@ Use to stop associating API keys with roles.
129
138
130
139
131
140
132
-
In JSON editor, you can use the view dropdown to select between Admin format and Core format. Note, that these formatting options are for your convenience only and do not render properties as they are defined in DIAL Core. After making changes, the **Sync with core** indicator on the main configuration screen will inform you about the synchronization state with DIAL Core.
141
+
In JSON editor, you can use the view dropdown to select between Admin format and Core format. Note, that these formatting options are for your convenience only and do not render properties as they are defined in DIAL Core.
133
142
134
143
##### Working with JSON Editor
135
144
136
145
1. Navigate to **Access Management → Keys**, then select the key you want to edit.
137
146
2. Click the **JSON Editor** toggle (top-right). The UI reveals the raw JSON.
138
147
3. Chose between the Admin and Core format to see and work with properties in the necessary format. **Note**: Core format view mode does not render the actual configuration stored in DIAL Core but the configuration in Admin service displayed in the DIAL Core format.
139
-
4. Make changes and click **Save** to apply them.
140
-
5. After making changes, the **Sync with core** indicator on the main configuration screen will inform you about the synchronization state with DIAL Core.
141
-
142
-
## Delete
143
-
144
-
Click **Delete** on the main screen to permanently remove the selected key.
145
-
146
-
> **Note**: All related entities (applications, models, routes) bound to the deleted API key will fail.
0 commit comments