Edit

Limit access based on role

By default, users have permissions to access Control Tower and WorkSpace. To restrict access to WorkSpace but allow working in Control Tower, enable ws.roles.config.enabled.

After ws.roles.config.enabled is switched to true, a user without the wf-workspace Worker role has no access to any WorkSpace resource.

Configure Keycloak

Go to the Keycloak web application.

Create Mapper

1. Choose WorkfusionRealm.

2. Open the Clients section.

3. Select the wf-workspace client.

   

4. Go to the Mappers tab.

   

5. Click the Create button.

   

6. Fill in the Create Protocol Mapper form with the following values:

   • Name: Roles Mapper
   • Mapper Type: User Client Role
   • Client ID: wf-workspace
   • Client Role prefix: ws_
   • Multivalued: true
   • Token Claim Name: roles
   • Claim JSON Type: keep the default one—Select One
   • Add to ID token: true
   • Add to access token: true
   • Add to userinfo: true

   

7. Click the Save button.

8. Go back to the wf-workspace client. In the Mappers tab, you should have Roles Mapper.

   

Create Role

1. Go back to the wf-workspace client and open the Roles tab.

2. Click the Create new Role button.

   

3. Fill in the Create New Role form with the following values:

   • Name: Worker
   • Description: Role that gives access to work with assignments in WorkSpace

   

4. Click the Save button.

Configure WorkSpace

Set property in ZooKeeper

You can change application properties via the ZooKeeper service:

1. Log into ZooNavigator and go to the WorkSpace properties location that is the /config/workspace folder.
2. Find the ws.roles.config.enabled property. If it doesn't exist, create a new node for the property: /config/workspace/ws.roles.config.enabled.
3. Set the property value to true and save changes.

For more details on connecting and working with ZooKeeper via ZooNavigator, see Set properties in ZooKeeper.

Restart WorkSpace

To restart WorkSpace, perform the following steps:

1. Go to the server where the application runs.
2. Open the terminal or connect to the server's terminal via SSH. For more details, refer to Work with Linux instance.
3. In the terminal, execute the wfmanager restart workspace command.
4. Wait until the command execution finishes.

Assign Worker role to users

1. Go to the Keycloak web application, open the Users section, and click the user you want to grant access to WorkSpace.

   

2. Open the Role Mappings tab and choose wf-workspace in the Client Roles drop-down menu.

3. Select the Worker role and click the Add button.

   

   Now, the user has the Worker role and can access the WorkSpace application.