Access Control

Overview¶

Flowctl implements a comprehensive Role-Based Access Control (RBAC) system that manages user permissions through roles and namespaces. Access control is enforced using Casbin.

Key Concepts¶

Flowctl has two levels of user roles:

1. Global User Roles - Applied at the application level
2. Superuser: Has admin access to all namespaces and can manage all resources

3. User: Standard user who only has flow execution access in the default namespace

4. Namespace Roles - Applied within specific namespaces

5. User: Can view and execute flows, can only see their own executions
6. Operator: Everything a User can do, plus view all executions and view flow configurations
7. Reviewer: Can view flows, executions, and approve flow actions
8. Admin: Full control over namespace resources

Namespaces¶

Namespaces are logical containers that organize and isolate resources in flowctl. Each namespace can contain:

• Flows
• Executions
• Nodes (remote servers)
• Credentials
• Secrets
• Members (users and groups with roles)

Default Namespace¶

When you first install flowctl, a default namespace is automatically created. You can organize your flows into additional namespaces as needed.

Namespace Roles and Permissions¶

User Role¶

The User role is the most restrictive namespace role, suitable for team members who need to run flows but not modify them.

Permissions:

• ✓ View flows
• ✓ Execute flows
• ✓ View own executions only
• ✓ View namespace information
• ✓ View namespace members
• ✗ View other users' executions
• ✗ View flow configuration/definition
• ✗ Create, update, or delete flows
• ✗ Approve flow actions
• ✗ Manage nodes, credentials, or secrets
• ✗ Manage namespace members

Operator Role¶

The Operator role inherits all User permissions and adds visibility into all executions and flow configurations. Suitable for team members who need operational oversight without the ability to approve or modify flows.

Permissions:

• ✓ All User role permissions
• ✓ View all executions (not restricted to own)
• ✓ View flow configurations (read-only)
• ✗ Create, update, or delete flows
• ✗ Approve flow actions
• ✗ Manage nodes, credentials, or secrets
• ✗ Manage namespace members

Reviewer Role¶

The Reviewer role inherits all Operator permissions and adds approval capabilities.

Permissions:

• ✓ All User role permissions
• ✓ View approval requests
• ✓ Approve or reject flow actions
• ✗ Create, update, or delete flows
• ✗ Manage nodes, credentials, or secrets
• ✗ Manage namespace members

Admin Role¶

The Admin role has full control over all resources within a namespace.

Permissions:

• ✓ All Reviewer role permissions
• ✓ Create, update, and delete flows
• ✓ View, create, update, and delete nodes
• ✓ View, create, update, and delete credentials
• ✓ View, create, update, and delete secrets
• ✓ Add and remove namespace members
• ✓ Update member roles

Permission Matrix¶

Here's a complete breakdown of what each namespace role can do:

Managing Namespace Members¶

Adding Members to a Namespace¶

Namespace admins can add users or groups to their namespace:

1. Go to the "Members" section
2. Click "Add Member"
3. Select the user or group
4. Assign a role (User, Operator, Reviewer, or Admin)
5. Save

Groups¶

Flowctl supports groups for easier permission management. Instead of assigning roles to individual users, you can:

1. Create a group (e.g., "DevOps Team", "QA Team")
2. Add users to the group
3. Assign the group to namespaces with specific roles

When a user is added to a group, they automatically inherit all namespace access that the group has.

Authentication¶

Admin User¶

The initial admin user configured in config.toml can authenticate using username and password. This user automatically has the "superuser" global role.

[app]
  admin_username = "admin"
  admin_password = "secure_password"

OIDC Authentication¶

All non-admin users authenticate via SSO using OIDC. Configure OIDC in your config.toml:

[[oidc]]
name = "oidc"
client_id = "your-client-id"
client_secret = "your-client-secret"
issuer = "https://your-oidc-provider.com/"

Auto-Creating Users on Login¶

By default, a user must already exist in flowctl before they can log in via OIDC. Enable auto_create_users on an OIDC provider to create accounts automatically on first login.

[[oidc]]
name = "oidc"
client_id = "your-client-id"
client_secret = "your-client-secret"
issuer = "https://your-oidc-provider.com/"

auto_create_users.enabled = true
auto_create_users.namespace = "default"
auto_create_users.role = "user"
auto_create_users.groups = ["developers"]
auto_create_users.allowed_domains = ["example.com"]

Options: