teleport/docs/pages/desktop-access/rbac.mdx

---
title: Role-Based Access Control for Desktop Access
description: Role-based access control (RBAC) for Teleport Desktop Access
---

Teleport's RBAC allows administrators to set up granular access policies for
Windows desktops connected to Teleport.

Teleport's `role` resource provides the following options for controlling
desktop access:

```yaml
kind: role
version: v4
metadata:
  name: developer
spec:
  options:
    # Specify whether or not to record the user's desktop sessions.
    # Desktop session recording is enabled if one or more of the user's
    # roles has enabled recording. Defaults to true if unspecified.
    # Desktop sessions will never be recorded if auth_service.session_recording
    # is set to 'off' in teleport.yaml or if the cluster's session_recording_config
    # resource has set 'mode: off'.
    record_session:
      desktop: true

    # Specify whether clipboard sharing should be allowed with the
    # remote desktop (requires a supported browser). Defaults to true
    # if unspecified. If one or more of the user's roles has disabled
    # the clipboard, then it will be disabled.
    desktop_clipboard: true
  allow:
    # Label selectors for desktops this role has access to.
    windows_desktop_labels:
      environment: ["dev", "stage"]

    # Windows user accounts this role can connect as.
    windows_desktop_logins: ["Administrator", "{{internal.windows_logins}}"]
```

<Admonition type="warning" title="Active Directory Configuration">
  Teleport's RBAC system is not a replacement for proper Active Directory
  administration. Teleport-issued Windows certificates are valid for a small
  amount of time, but they do apply to the entire domain. Proper care should be
  taken to ensure that each Teleport user's roles reflect only the necessary
  Windows logins, and that these Windows users are properly secured.
</Admonition>

## Labeling

Both `allow` and `deny` rules support `windows_desktop_labels` selectors. These
selectors are matched against the labels set on the desktop. It is possible to
use wildcards (`"*"`) to match all desktop labels.

Windows desktops acquire labels in two ways:

1. Using the `host_labels` rules defined in the `windows_desktop_service` section
   of your Teleport configuration file.
2. Using LDAP (for desktops discovered via LDAP only)

### Using `host_labels`

The following `host_labels` configuration would apply the `environment: dev`
label to a Windows desktop named `test.dev.example.com` and the
`environment: prod` label to `desktop.prod.example.com`:

```yaml
host_labels:
  - match: '^.*\.dev\.example\.com$'
    labels:
      environment: dev
  - match: '^.*\.prod\.example\.com$'
    labels:
      environment: prod
```

### Using LDAP

Teleport Desktop Access can automatically discover Windows Desktops and register
them with the Teleport Cluster by periodically querying an LDAP server. There
are several ways that these desktops can be labeled:

Teleport applies the following labels automatically to all desktops discovered
via LDAP:

| Label                               | LDAP Attribute                                                                                  | Example                       |
| ----------------------------------- | ----------------------------------------------------------------------------------------------- | ----------------------------- |
| `teleport.dev/computer_name`        | `name`                                                                                          | `WIN-I5G06B8RT33`             |
| `teleport.dev/dns_host_name`        | [`dNSHostName`](https://docs.microsoft.com/en-us/windows/win32/adschema/a-dnshostname)          | `WIN-I5G06B8RT33.example.com` |
| `teleport.dev/os`                   | [`operatingSystem`](https://docs.microsoft.com/en-us/windows/win32/adschema/a-operatingsystem)  | `Windows Server 2012`         |
| `teleport.dev/os_version`           | [`osVersion`](https://docs.microsoft.com/en-us/windows/win32/adschema/a-operatingsystemversion) | `4.0`                         |
| `teleport.dev/windows_domain`       | Sourced from config                                                                             | `example.com`                 |
| `teleport.dev/is_domain_controller` | `primaryGroupID`                                                                                | `true`                        |
| `teleport.dev/ou`                   | Derived from `distinguishedName`                                                                | `OU=IT,DC=goteleport,DC=com`  |

Additionally, users can configure
[LDAP attributes](https://docs.microsoft.com/en-us/windows/win32/adschema/attributes-all)
which will be converted into Teleport labels. For example, consider the
following Desktop Access configuration:

```yaml
discovery:
  label_attributes:
    - location
```

For a desktop with a `location` attribute of `Oakland`, Teleport would apply a
label with key `ldap/location` and value `Oakland`.

## Logins

The `windows_desktop_logins` role setting lists the Windows user accounts that
the role permits access to. For local users, the `{{internal.windows_logins}}`
variable can be used as a placeholder for the user's `windows_logins` trait. The
`windows_logins` trait can be specified when the user is created with
`tctl users add alice --windows-logins=Administrator,DBUser`.

New clusters automatically populate the preset `access` role with the following:

```yaml
allow:
  windows_desktop_logins: ["{{internal.windows_logins}}"]
```

## Clipboard Access

In order for a user to copy and paste between a remote desktop and their local
workstation, clipboard sharing must be enabled for the user. The
`desktop_clipboard` role option defaults to enabled if unspecified. To disable
clipboard sharing for a Teleport user, ensure that they are assigned at least
one role that explicitly disables clipboard sharing:

```yaml
desktop_clipboard: false
```

## Directory Sharing

A Teleport user can share a directory on their local workstation with a remote
desktop using Directory Sharing.

A Teleport role enables Directory Sharing by default. If one of a user's
Teleport roles disables Directory Sharing, then Directory Sharing will be
disabled for that user.

To disable Directory Sharing for a Teleport user, define a role similar to the
following in a file called `role.yaml`:

```yaml
kind: role
version: v5
metadata:
  name: "no-sharing"
spec:
  options:
    desktop_directory_sharing: false
```

## Session Recording

In order for a Teleport user's desktop sessions to be recorded, the following must
both be true:

- Session recording is enabled (i.e. not set to `off`) on the cluster. This
  setting resides in `teleport.yaml` under `auth_service.session_recording`, but
  can also be configured dynamically via the cluster's
  `session_recording_config` resource.
- The user's roles enable desktop session recording.

By default, desktop session recording is considered enabled in Teleport roles
unless it is explicitly disabled:

```yaml
record_session:
  desktop: false
```

In order to disable desktop session recording for a user, *all* of the user's
roles must disable it. In other words, the presence of a single role which
enables recording is enough to ensure sessions are recorded.