Restrict access to specific users and groups

Restrict OpenShift Dev Spaces access to specific users and groups so that you can control which users are allowed or denied access to the platform.

Before you begin

Procedure

  1. Edit the CheCluster Custom Resource to add the advancedAuthorization section: 
    $ oc patch checluster devspaces --type=merge -n openshift-devspaces \
  --patch '{
    "spec": {
      "networking": {
        "auth": {
          "advancedAuthorization": {
            "allowUsers": ["<allow_users>"],
            "allowGroups": ["<allow_groups>"],
            "denyUsers": ["<deny_users>"],
            "denyGroups": ["<deny_groups>"]
          }
        }
      }
    }
  }'

    where:

    allowUsers
    List of users allowed to access Red Hat OpenShift Dev Spaces.
    allowGroups
    List of groups of users allowed to access Red Hat OpenShift Dev Spaces (for OpenShift Container Platform only).
    denyUsers
    List of users denied access to Red Hat OpenShift Dev Spaces.
    denyGroups

    List of groups of users denied access to Red Hat OpenShift Dev Spaces (for OpenShift Container Platform only).

    If a user is on both allow and deny lists, access is denied. If allowUsers and allowGroups are empty, all users are allowed except the ones on the deny lists. If denyUsers and denyGroups are empty, only the users from allow lists are allowed. If both allow and deny lists are empty, all users are allowed.

  2. Wait for the rollout of the OpenShift Dev Spaces server components to complete.

Results

  • Log in to the OpenShift Dev Spaces dashboard as a user on the allowUsers list and verify access to the dashboard.
  • Log in as a user on the denyUsers list and verify that OpenShift Dev Spaces displays the following message: 
    Advanced authorization is enabled. User might not be allowed. Please, contact the administrator.