Chapter 1. Enabling and giving access to the Role-Based Access Control (RBAC) feature

Procedure

1. The RBAC plugin is installed but disabled by default. To enable the ./dynamic-plugins/dist/janus-idp-backstage-plugin-rbac plugin, edit your dynamic-plugins.yaml with the following content.

   dynamic-plugins.yaml fragment

   plugins:
     - package: ./dynamic-plugins/dist/janus-idp-backstage-plugin-rbac
       disabled: false

   See Installing and viewing dynamic plugins.

2. Declare policy administrators to enable a select number of authenticated users to configure RBAC policies through the REST API or Web UI, instead of modifying the CSV file directly. The permissions can be specified in a separate CSV file referenced in the app-config-rhdh ConfigMap, or permissions can be created using the REST API or Web UI.

   To declare users such as <your_policy_administrator_name> as policy administrators, edit your custom Developer Hub ConfigMap, such as app-config-rhdh, and add following code to the app-config-rhdh.yaml content:

   app-config.yaml fragment

   permission:
     enabled: true
     rbac:
       admin:
         users:
           - name: user:default/<your_policy_administrator_name>

Verification

1. Sign out from the existing Red Hat Developer Hub session and log in again using the declared policy administrator account.

2. With RBAC enabled, most features are disabled by default.

   1. Navigate to the Catalog page in RHDH. The Create button is not visible. You cannot create new components.
   2. Navigate to the API page. The Register button is not visible.