Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Clarify RBAC rule application #11672

Merged
merged 6 commits into from
Apr 7, 2022
Merged

Clarify RBAC rule application #11672

Changes from 3 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
869d779
Clarify RBAC combinatorics
xacrimon Apr 1, 2022
8e66fb4
Remove superflous word
xacrimon Apr 1, 2022
bae790f
fix typo
xacrimon Apr 1, 2022
9cea8d2
Update docs/pages/access-controls/guides/moderated-sessions.mdx
xacrimon Apr 5, 2022
f070c06
reword
xacrimon Apr 5, 2022
9432a6b
Merge branch 'master' into joel/clarify-rbac-rule-application
xacrimon Apr 7, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions docs/pages/access-controls/guides/moderated-sessions.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,10 @@ spec:
count: 2
```

#### Combining Policies

The authorizer applies require policies within a role together with an OR operator and the sets from each role with an AND operator. In practice, this means that every role with at least one require policy requires one of its policies to be met before a session can be started.
Copy link
Contributor

@ptgott ptgott Apr 4, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • This is the first time we mention the authorizer. Is this the same as the Auth Service? If so, I think we should say "The Auth Service" so readers can better connect this paragraph with their knowledge of Teleport.
  • Is there a term defined earlier in the guide we can use instead of "the sets from each role"? I'm not confident that I understand what this refers to.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  1. The authorizer usually a common term for some control logic at any point in a stack that decides whether a user has access or not. This isn't a term frequently used in documentation I don't think but I don't have a better name for it since this code can be run at many different places.

  2. Reworded, is it clearer now?

xacrimon marked this conversation as resolved.
Show resolved Hide resolved

### `join_sessions`

#### Options
Expand Down