diff --git a/website/content/docs/concepts/security/permissions.mdx b/website/content/docs/concepts/security/permissions.mdx index 1e9dcb446f..e902cb6d1b 100644 --- a/website/content/docs/concepts/security/permissions.mdx +++ b/website/content/docs/concepts/security/permissions.mdx @@ -222,11 +222,11 @@ wildcard or templated grant strings.
account
- account
+ create: Create an account
type=<type>;actions=create
- type=<type>;actions=createlist: List accounts
type=<type>;actions=list
- type=<type>;actions=list<id>
- <id>
+ <auth-method-id>
- <auth-method-id>
+ account
- account
+ read: Read an account
id=<id>;actions=read
- id=<pin>;type=<type>;actions=read
- id=<id>;actions=readid=<pin>;type=<type>;actions=readupdate: Update an account
id=<id>;actions=update
- id=<pin>;type=<type>;actions=update
- id=<id>;actions=updateid=<pin>;type=<type>;actions=updatedelete: Delete an account
id=<id>;actions=delete
- id=<pin>;type=<type>;actions=delete
- set-password: Set a password on an account, without
- requring the current password
- id=<id>;actions=set-password
- id=<pin>;type=<type>;actions=set-password
- change-password: Change a password on an account given
- the current password
- id=<id>;actions=change-password
-
- id=<pin>;type=<type>;actions=change-password
-
- id=<id>;actions=deleteid=<pin>;type=<type>;actions=deleteset-password: Set a password on an account, without requring the current password
+ id=<id>;actions=set-passwordid=<pin>;type=<type>;actions=set-passwordchange-password: Change a password on an account given the current password
+ id=<id>;actions=change-passwordid=<pin>;type=<type>;actions=change-passwordauth-method
- auth-method
+ create: Create an auth method
type=<type>;actions=create
- type=<type>;actions=createlist: List auth methods
type=<type>;actions=list
- type=<type>;actions=list<id>
- <id>
+ auth-method
- auth-method
+ read: Read an auth method
id=<id>;actions=read
- id=<id>;actions=readupdate: Update an auth method
id=<id>;actions=update
- id=<id>;actions=updatedelete: Delete an auth method
id=<id>;actions=delete
- id=<id>;actions=deleteauthenticate: Authenticate to an auth method
id=<id>;actions=authenticate
- id=<id>;actions=authenticateauth-token
- auth-token
+ list: List auth tokens
type=<type>;actions=list
- type=<type>;actions=list<id>
- <id>
+ auth-token
- auth-token
+ read: Read an auth token
id=<id>;actions=read
- id=<id>;actions=readdelete: Delete an auth token
id=<id>;actions=delete
- id=<id>;actions=deletegroup
- group
+ create: Create a group
type=<type>;actions=create
- type=<type>;actions=createlist: List groups
type=<type>;actions=list
- type=<type>;actions=list<id>
- <id>
+ group
- group
+ read: Read a group
id=<id>;actions=read
- id=<id>;actions=readupdate: Update a group
id=<id>;actions=update
- id=<id>;actions=updatedelete: Delete a group
id=<id>;actions=delete
- id=<id>;actions=deleteadd-members: Add members to a group
id=<id>;actions=add-members
- id=<id>;actions=add-membersset-members: Set the full set of members on a group
id=<id>;actions=set-members
- id=<id>;actions=set-membersremove-members: Remove members from a group
id=<id>;actions=remove-members
- id=<id>;actions=remove-membershost
- host
+ create: Create a host
type=<type>;actions=create
- type=<type>;actions=createlist: List hosts
type=<type>;actions=list
- type=<type>;actions=list<id>
- <id>
+ <host-catalog-id>
- <host-catalog-id>
+ host
- host
+ read: Read a host
id=<id>;actions=read
- id=<pin>;type=<type>;actions=read
- id=<id>;actions=readid=<pin>;type=<type>;actions=readupdate: Update a host
id=<id>;actions=update
- id=<pin>;type=<type>;actions=update
- id=<id>;actions=updateid=<pin>;type=<type>;actions=updatedelete: Delete a host
id=<id>;actions=delete
- id=<pin>;type=<type>;actions=delete
- id=<id>;actions=deleteid=<pin>;type=<type>;actions=deletehost-catalog
- host-catalog
+ create: Create a host catalog
type=<type>;actions=create
- type=<type>;actions=createlist: List host catalogs
type=<type>;actions=list
- type=<type>;actions=list<id>
- <id>
+ host-catalog
- host-catalog
+ read: Read a host catalog
id=<id>;actions=read
- id=<id>;actions=readupdate: Update a host catalog
id=<id>;actions=update
- id=<id>;actions=updatedelete: Delete a host catalog
id=<id>;actions=delete
- id=<id>;actions=deletehost-set
- host-set
+ create: Create a host set
type=<type>;actions=create
- type=<type>;actions=createlist: List host sets
type=<type>;actions=list
- type=<type>;actions=list<id>
- <id>
+ <host-catalog-id>
- <host-catalog-id>
+ host-set
- host-set
+ read: Read a host set
id=<id>;actions=read
- id=<pin>;type=<type>;actions=read
- id=<id>;actions=readid=<pin>;type=<type>;actions=readupdate: Update a host set
id=<id>;actions=update
- id=<pin>;type=<type>;actions=update
- id=<id>;actions=updateid=<pin>;type=<type>;actions=updatedelete: Delete a host set
id=<id>;actions=delete
- id=<pin>;type=<type>;actions=delete
- id=<id>;actions=deleteid=<pin>;type=<type>;actions=deleteadd-hosts: Add hosts to a host-set
id=<id>;actions=add-hosts
- id=<pin>;type=<type>;actions=add-hosts
- id=<id>;actions=add-hostsid=<pin>;type=<type>;actions=add-hostsset-hosts: Set the full set of hosts on a host set
id=<id>;actions=set-hosts
- id=<pin>;type=<type>;actions=set-hosts
- id=<id>;actions=set-hostsid=<pin>;type=<type>;actions=set-hostsremove-hosts: Remove hosts from a host set
id=<id>;actions=remove-hosts
- id=<pin>;type=<type>;actions=remove-hosts
- id=<id>;actions=remove-hostsid=<pin>;type=<type>;actions=remove-hostsrole
- role
+ create: Create a role
type=<type>;actions=create
- type=<type>;actions=createlist: List roles
type=<type>;actions=list
- type=<type>;actions=list<id>
- <id>
+ role
- role
+ read: Read a role
id=<id>;actions=read
- id=<id>;actions=readupdate: Update a role
id=<id>;actions=update
- id=<id>;actions=updatedelete: Delete a role
id=<id>;actions=delete
- id=<id>;actions=deleteadd-principals: Add principals to a role
id=<id>;actions=add-principals
- id=<id>;actions=add-principalsset-principals: Set the full set of principals on a
- role
+ set-principals: Set the full set of principals on a role
id=<id>;actions=set-principals
- id=<id>;actions=set-principalsremove-principals: Remove principals from a role
id=<id>;actions=remove-principals
- id=<id>;actions=remove-principalsadd-grants: Add grants to a role
id=<id>;actions=add-grants
- id=<id>;actions=add-grantsset-grants: Set the full set of grants on a role
id=<id>;actions=set-grants
- id=<id>;actions=set-grantsremove-grants: Remove grants from a role
id=<id>;actions=remove-grants
- id=<id>;actions=remove-grantsscope
- scope
+ create: Create a scope
type=<type>;actions=create
- type=<type>;actions=createlist: List scopes
type=<type>;actions=list
- type=<type>;actions=list<id>
- <id>
+ scope
- scope
+ read: Read a scope
id=<id>;actions=read
- id=<id>;actions=readupdate: Update a scope
id=<id>;actions=update
- id=<id>;actions=updatedelete: Delete a scope
id=<id>;actions=delete
- id=<id>;actions=deletesession
- session
+ list: List sessions
type=<type>;actions=list
- type=<type>;actions=list<id>
- <id>
+ session
- session
+ read: Read a session
id=<id>;actions=read
- id=<id>;actions=readcancel: Cancel a session
id=<id>;actions=cancel
- read:self: Read a session, which must be associated
- with the calling user
- id=*;type=session;actions=read:self
- cancel:self: Cancel a session, which must be associated
- with the calling user
- id=*;type=session;actions=cancel:self
- id=<id>;actions=cancelread:self: Read a session, which must be associated with the calling user
+ id=*;type=session;actions=read:selfcancel:self: Cancel a session, which must be associated with the calling user
+ id=*;type=session;actions=cancel:selftarget
- target
+ create: Create a target
type=<type>;actions=create
- type=<type>;actions=createlist: List targets
type=<type>;actions=list
- type=<type>;actions=list<id>
- <id>
+ target
- target
+ read: Read a target
id=<id>;actions=read
- id=<id>;actions=readupdate: Update a target
id=<id>;actions=update
- id=<id>;actions=updatedelete: Delete a target
id=<id>;actions=delete
- id=<id>;actions=deleteadd-host-sets: Add host sets to a target
id=<id>;actions=add-host-sets
- id=<id>;actions=add-host-setsset-host-sets: Set the full set of host sets on a
- target
+ set-host-sets: Set the full set of host sets on a target
id=<id>;actions=set-host-sets
- id=<id>;actions=set-host-setsremove-host-sets: Remove host sets from a target
id=<id>;actions=remove-host-sets
- id=<id>;actions=remove-host-setsauthorize-session: Authorize a session via the target
id=<id>;actions=authorize-session
- id=<id>;actions=authorize-sessionuser
- user
+ create: Create a user
type=<type>;actions=create
- type=<type>;actions=createlist: List users
type=<type>;actions=list
- type=<type>;actions=list<id>
- <id>
+ user
- user
+ read: Read a user
id=<id>;actions=read
- id=<id>;actions=readupdate: Update a user
id=<id>;actions=update
- id=<id>;actions=updatedelete: Delete a user
id=<id>;actions=delete
- id=<id>;actions=deleteadd-accounts: Add accounts to a user
id=<id>;actions=add-accounts
- id=<id>;actions=add-accountsset-accounts: Set the full set of accounts on a user
id=<id>;actions=set-accounts
- id=<id>;actions=set-accountsremove-accounts: Remove accounts from a user
id=<id>;actions=remove-accounts
- id=<id>;actions=remove-accounts