CODEWITHSUNDEEP
rundeck
cnrdvdsmt
cnrdvdsmt

Reputation: 45

Creating ACL for User Permissions in Rundeck

Good day all,

I am trying to create an ACL in Rundeck CE that will allow a user to only view, execute, and kill jobs that have been configured by an admin user. The ACL is also supposed to allow these permissions to all project that have been created in rundeck.

I have added the user to the "user" group in the realm.properties file and have created what I thought was the correct ACL. Howveer, when I log in to the web ui of this user I get the following error message:

You have no authorized access to projects.
Contact your administrator. (User roles: user)

The following is the entry in the realm.properties file for the creation of the user in question:

user:password,user

The following is the ACL I have created to allow the user to view execute and kill jobs on all projects.

description: User permission ACL
context: 
  project: '.*'
for:
  resource: 
    - allow: [read]
  job: 
    - allow: [read,run.kill]
by:
  username: 'user'
  
---

description: User Permission ACL
context:
  application: 'rundekck'
for:
  resource: 
    - allow: [read]
  job: 
    - allow: [read,run.kill]
by:
  username: 'user'

This is the first time I have tried to create a system ACL so please forgive me if I am missing something obvious. I used the documentation on Rundeck's website to write this as well.

Any pointers or tips would be much appreciated

Upvotes: 0

Views: 721

Answers (1)

MegaDrive68k
MegaDrive68k

Reputation: 4325

You have three things to change:

  1. Change application: 'rundekck' by application: 'rundeck'.
  2. On your actions you're using read,run.kill use read,run,kill.
  3. Add the project section on the app context.

The ACL works in the following way:

description: User permission ACL
context: 
  project: '.*'
for:
  resource: 
    - allow: [read]
  job: 
    - allow: [read,run,kill]
by:
  username: 'user'
  
---

description: User Permission ACL
context:
  application: 'rundeck'
for:
  resource: 
    - allow: [read]
  project:
    - allow: '*'
  job: 
    - allow: [read,run,kill]
by:
  username: 'user'

Here you can see a lot of useful ACL examples.

Upvotes: 0

Related Questions