You can manage authorization in your Wavefront environment by:
- Assigning and revoking roles for groups or accounts to give global permissions.
- Granting and revoking access to individual objects (initially dashboards and alerts) for accounts and groups.
- User accounts, discussed here, which authenticate with a user name and password.
- Service accounts, which authenticate with a token.
User accounts log in with a username and password.
- All authenticated users can perform certain tasks such as viewing dashboards and charts or sharing links to charts.
- Roles determine what users can do globally. Each role has one or more permissions. For example, assume an Interns role that has Dashboard permissions. All users with the Interns role can view and manage all dashboards.
- Access applies to individual objects. For example, some users don’t have access to a dashboard with financial data. Users who have modify access for a dashboard or alert can grant or revoke access for that object.
Create and Manage User Accounts
Users with Accounts, Groups & Roles permissions can manage accounts.
- Click the gear icon and select Account Management.
- To add an account:
- Click Invite New Users, and specify a comma-separated list of email addresses.
- Specify user groups. You cannot remove users from the Everyone group.
- To grant permissions to individual users, click Advanced.
- Assign a role to the user
- Or give the user explicit permissions We recommend managing permissions at the group level.
- To delete a user, change roles and permissions, or change group membership:
- Select one or more users on the Users page.
- Select the check box for one or more users.
- Click one of the Permission or Group icons or the trash can button, and confirm when prompted.
If you delete a user, you remove that user’s access to Wavefront.
Each invited user receives an email with an account activation link that is valid for 24 hours. All new users can browse data and might have additional permissions.
What Can a New User Do?
When you invite a (human) user to Wavefront, what that new user can do depends on several factors.
- New User Tasks: All Wavefront users can perform the following tasks:
- View the dashboards, alerts, metrics, sources, events, maintenance windows, and alert notification pages
- Add dashboards to the list of favorites
- View existing dashboards and charts
- Create and interact with charts – but NOT save charts
- Share links to dashboards and charts with other users
- Access the user profile from the gear icon
- New User Permissions: Users with Accounts, Groups & Roles permission can view and modify new user default permissions from the System Preferences menu item available from gear icon. These permissions do not apply to service accounts.
- New User Default Groups: Users with Accounts, Groups & Roles permission can set up a default groups for new users from the System Preferences menu item available from the gear icon. All new user accounts get all permissions assigned to the default user groups. These permissions do not apply to service accounts.
A service account can be used to automate management of objects like dashboard, alerts, etc. A service account can’t perform the UI operations that all user accounts can perform by default.
- A service account uses a token to authenticate.
- Each account is automatically added to the Everyone group. If a role is assigned to that group, the service account gets the permissions from that role.
- Service account can be added to any group to get that group’s role (and permissions).
How Service Accounts Work
If you build a service or tool that manages proxies or ingests data, then that tool must authenticate to the Wavefront API.
- Create a service account from the Wavefront UI. The service account name must be unique.
- Assign a role to the account to give the account the permissions it needs. Service accounts can perform get, modify, and delete tasks only if they have the necessary permissions.
Configure your tool to pass the service account credentials (API token) to the Wavefront API.
The tool authenticates seamlessly to the API without embedding secret keys or user credentials in your instance, image, or application code.
You can disable a service account if you temporarily don’t need it, or delete it permanently.
Create a Service Account
Creating a service account is different from creating a user account.
- From the gear icon, select Account Management.
- Click the Service Accounts tab, and click Create New Account.
- On the New Service Account page, specify the account details and click Create.
|Account ID||ID of the account. We prefix this ID with sa::.
A service account name must be unique. Wavefront converts service account ID to lower case. Users can type upper case or lower case -- this helps avoid duplicates.
|Tokens||List of API tokens that the service account can use to authenticate to Wavefront.
|Groups||By default, service accounts are added to the Everyone group and you cannot remove them. If you give assign roles to the Everyone group, all the service account get the permissions associated with that role. You can also add a service accounts to other groups.|
|Roles||Roles for the service account. Roles are sets of permissions. You could create one or two roles and use those roles only for service accounts.|
|Permissions||Individual permissions assigned to this service account. For example, give the account Proxies permission to interact with proxies or Alerts permissions to retrieve data from alerts.|
After you create the account, you can change role or group assignment for individual accounts. The process is the same for user accounts and service accounts.
Deactivate or Activate a Service Account
You can temporarily (or permanently) deactivate a service account. When an account is deactivated, none of the corresponding tokens work.
You can activate or deactivate a service account from the Service Accounts page or from the Edit Service Account page.
To activate or deactivate an account from the Service Accounts page:
To activate or deactivate an account from the Edit Service Account page: