mirror of
https://github.com/gravitational/teleport.git
synced 2026-10-16 07:44:31 +08:00
85 lines
2.3 KiB
Plaintext
85 lines
2.3 KiB
Plaintext
---
|
|
title: Application Access Role-Based Access Control
|
|
description: Role-Based Access Control (RBAC) for Teleport Application Access.
|
|
---
|
|
|
|
# Application Access Role-Based Access Control
|
|
|
|
This article describes Access Control concepts particularly relevant to Teleport Application Access.
|
|
|
|
## Assigning labels to applications
|
|
|
|
Teleport Application Access uses labels to control access to the proxied
|
|
web applications.
|
|
|
|
Teleport administrators can assign static and dynamic labels to apps using
|
|
configuration:
|
|
|
|
```yaml
|
|
apps:
|
|
- name: "grafana"
|
|
uri: "http://localhost:3000"
|
|
# Static labels.
|
|
labels:
|
|
env: "prod"
|
|
group: "metrics"
|
|
# Teleport periodically executes commands in dynamic labels and uses the
|
|
# commands output in label values.
|
|
commands:
|
|
- name: "arch"
|
|
command: ["uname", "-p"]
|
|
period: 1m0s
|
|
```
|
|
|
|
## Configuring application labels in roles
|
|
|
|
Teleport administrators can configure roles to allow or deny users' access to
|
|
applications with specific labels using `app_labels` property.
|
|
|
|
For example, this role will grant access to all applications from the group
|
|
"metrics", except for the production ones:
|
|
|
|
```yaml
|
|
kind: role
|
|
version: v5
|
|
metadata:
|
|
name: dev
|
|
spec:
|
|
allow:
|
|
app_labels:
|
|
group: "metrics"
|
|
deny:
|
|
app_labels:
|
|
env: "prod"
|
|
```
|
|
|
|
## Integrating with identity providers
|
|
|
|
You can configure roles to populate app labels dynamically based on the user's
|
|
claims and attributes received from identity providers. This is done by using
|
|
template variables with `external` prefix.
|
|
|
|
For example, this role will have its `env` and `group` label values set after
|
|
the Okta user's attributes with the same names:
|
|
|
|
```yaml
|
|
allow:
|
|
app_labels:
|
|
env: "{{external.env}}"
|
|
group: "{{external.group}}"
|
|
```
|
|
|
|
## Next steps
|
|
|
|
- View access controls [Getting Started](../access-controls/getting-started.mdx)
|
|
and other available [guides](../access-controls/guides.mdx).
|
|
- Learn about using [JWT tokens](./guides/jwt.mdx) to implement access controls
|
|
in your application.
|
|
- Integrate with your identity provider:
|
|
- [OIDC](../enterprise/sso/oidc.mdx)
|
|
- [ADFS](../enterprise/sso/adfs.mdx)
|
|
- [Azure AD](../enterprise/sso/azuread.mdx)
|
|
- [Google Workspace](../enterprise/sso/google-workspace.mdx)
|
|
- [Onelogin](../enterprise/sso/one-login.mdx)
|
|
- [Okta](../enterprise/sso/okta.mdx)
|