User Access Control (RBAC)

Cockpit implements Role-Based Access Control (RBAC) to secure cluster resources and manage user authentication. RBAC ensures that administrative permissions conform to the principle of least privilege.

---

Core Security Concepts

The Cockpit access control model is structured around five primary entities:

Entity	Description	Technical Function
Tenant / Organization	The primary logical partition.	Isolates users and resources across multiple customers or business units.
Group	A logical collection of users.	Allows permissions to be assigned to multiple accounts simultaneously.
Role	A pre-defined collection of privileges.	Defines a profile of administrative capabilities (e.g., Administrator, Operator).
Privilege	A granular security permission.	Represents permission to execute a specific action (e.g., vm.create, host.reboot).
Scope	A target boundary mapping in the inventory tree.	Restricts role privileges to specific entities (e.g., Datacenters, Clusters, or Hosts).

---

User Identity Management

Administrators manage user configurations and authentication domains through the following features:

1. Local User Accounts: Created directly inside the Cockpit database. Each account includes a unique username, primary email address, and a hashed password representation.
2. External Authentication Domains: External identity providers (LDAP, Active Directory, SAML) can be registered to delegate authentication.
3. Password Security Policy: Enforce corporate security compliance via password strength requirements, maximum password age rules, and automatic account locking (e.g., locking an account for a duration of 30 minutes after 5 consecutive authentication failures).

---

Configuring Scoped Access Mappings

To assign granular privileges to a user or group for a specific resource node (such as a single physical host or virtual machine folder):

1. Log into the Cockpit console with administrative credentials.
2. Navigate to Administration > Access Control in the sidebar navigation.
3. Select the target User or Group to modify.
4. Select Create Permission Mapping and configure the fields:
   • Subject: Specify the target user or group (e.g., devops-team).
   • Role: Select the desired role containing the required privilege set (e.g., VM-Operator).
   • Scope (Target): Select the node in the inventory tree (e.g., a specific folder, cluster, or Vapor host) where the permissions will be enforced.
5. Save the configuration. Cockpit immediately updates the authorization matrix; the user's next session will be restricted to the specified inventory scope.