Managing user roles
Every user of the SC//Reliant™ platform must have a role assigned to their account. The role determines the set of permissions (also referred to as capabilities) assigned to their account. A basic set of global roles based on standard roles within a company are available. When the global roles don't fit your company structure, Scale Computing can create custom roles for your organization with a different set of capabilities. For more detail about each of the permissions, see Managing user permissions.
Role design
Roles in the SC//Reliant platform are built around separation of duties and least privilege. The built-in global roles model the most common operational responsibilities: read-only consumption of data (Reader), day-to-day creation and update of inventory and services (Editor), administration of users and platform configuration (Manager), security-policy administration (Security Manager), and installation work (Integrator), so the typical organization can assign people to the role that matches their documented job function without a custom role.
Each user is assigned exactly one role, and role assignments are intended to be reviewed at every role change or termination event. When the built-in roles do not align with a particular separation of duties, for example, an operations team that needs to manage firewall policies but not users, or a vendor that needs to update node serial numbers but nothing else, Scale Computing can create a custom role with the exact capabilities and property scopes required. For more information, see Custom roles.
Role scope
Each role is either global or assigned to one or more sites.
- Global role. Available to users of every site. The built-in roles described in Global roles are global roles.
- Site-specific role. Assigned to one or more sites, and available only to users whose Assigned Sites include at least one of those sites. A role can be shared across several sites, for example the UAT and production sites of the same organization, so that users have the same permissions in each without the role being global.
A role determines what a user can do, not which sites they can open. Site access comes from the user's Assigned Sites. For more information, see Sites and access.
Global roles
The SC//Reliant platform has the following basic global roles.
| Role | Description | Permissions |
|---|---|---|
| Manager | The Manager role has all permissions related to administering their SC//Reliant environment. |
|
| Editor | The Editor role has the ability to create and update stores, nodes, servers, payment devices, and firewall settings. |
|
| Reader | The Reader role has read-only access to stores, nodes, servers, payment devices, and firewall settings. The only write access they have to a resource is the ability to update the serial number of a node. |
|
| Integrator | The Integrator role is typically used for someone who is installing or building an SC//Reliant environment. This role has read-only access to nodes, node groups, and servers. It also grants permission to batch create QR codes for nodes which is used to monitor the installation of a node. |
|
| Security Manager | The Security Manager role has permissions to manage the areas of the SC//Reliant platform related to security. It includes a subset of permissions that are also granted to the Manager global role. |
|
Custom roles
When the capabilities in the global roles don't match what a job function in your organization needs, Scale Computing creates a custom role for you. A custom role contains the capabilities the job function requires, and can also limit which node and node group properties its users can edit. For more information, see Property-scoped permissions. A custom role can be specific to one site or shared across several; for example, an organization with separate UAT and production sites can use one role for both.
To request a custom role, or a change to an existing one, contact your Scale Computing Account Manager.