# Manage RBAC roles with Control Center on Confluent Platform Manage RBAC role assignments (role bindings) for users and groups to a cluster scope and resource scopes in the Control Center UI. You can add and delete role assignments. Role assignments cannot be edited; you must delete an assignment and add it again for any necessary changes. Role assignments in Confluent Platform RBAC operate on an allow model only. Deny role assignments are not supported. Only predefined (built-in) roles are supported; custom roles are not supported. ## Prerequisites - RBAC is [enabled](c3-rbac.md#c3-config-rbac) for Control Center and all Confluent Platform components in your environment. Refer to the [Prerequisites](c3-rbac.md#c3-rbac-prereqs) in the Control Center RBAC configuration documentation. - You are assigned an [appropriate role](#c3-rbac-reqd-manage-roles-ui) to manage RBAC role assignments in Control Center. ## Role permissions required for managing roles If you have the appropriate role permissions, you can administer RBAC role assignments in the Control Center UI rather than using the [Confluent CLI](https://docs.confluent.io/confluent-cli/current/index.html). The following predefined RBAC roles can manage roles or view roles for other users in Confluent Platform: - `SystemAdmin` - `UserAdmin` - `ResourceOwner` (for their respective resources only) - `SecurityAdmin` (can view but not manage the Cluster and Resource roles. Add and remove buttons are not visible.) #### IMPORTANT If a principal is a Kafka `super.user` but does not have a role assignment, they cannot view or assign roles using the Control Center UI. The `super.user` can still use the CLI to assign roles. For more information on `super.user` access and use, see [Troubleshoot role assignments](#c3-rbac-troubleshoot-role-assignments). For complete descriptions of each role, review the [Roles page](#c3-rbac-roles-page-manage) in the UI and the [predefined-RBAC roles](/platform/current/security/authorization/rbac/rbac-predefined-roles.html) documentation. When RBAC is enabled for Control Center, and you have the proper role permissions, the **View my role assignments** and the **Manage role assignments** options appear on the Control Center Administration menu: ![Control Center Administration menu role assignments](images/c3-admin-menu-rbac-roles.png) If you do not have a role that allows managing RBAC role assignments, the **Manage role assignments** option does not appear in the Administration menu. ### Roles page To access the Roles page, click the **Manage role assignments** option from the Control Center **Administration** menu. Use this page to view the available RBAC roles and their descriptions. #### NOTE There are no actions to take on this page; it is for informational purposes only. ![Confluent Platform RBAC roles and descriptions](images/c3-rbac-manage-roles-view.png) ### Manage Role Assignments page To access the Assignments page: 1. From the Control Center **Administration** menu, click the **Manage role assignments** option. 2. Click the **Assignments** tab. Use this page to: - View the clusters for which you can manage permissions. - Search for clusters by name and ID. - View existing cluster-level assignments. - Filter the cluster view by cluster type: Connect, Kafka, ksqlDB, Schema Registry. #### NOTE If there is only one type of cluster for which you are authorized to manage role assignments, the **Cluster type** (All clusters) list does not appear. Only the cluster types that you have role permissions to manage appear in the list. - Drill into a cluster to access the Cluster roles and Resource roles pages where you can [add](#c3-rbac-add-role-assignments) and [delete role assignments](#c3-rbac-delete-role-assignments) for Groups and Users. ![Confluent Platform Cluster Role Assignments page](images/c3-rbac-manage-cluster-assign.png) ## Add a role assignment Add a role assignment (role binding) using the Control Center UI. You must have an [appropriate role](#c3-rbac-reqd-manage-roles-ui) to add a role assignment. To use the CLI to add a role assignment, see [confluent iam rbac role-binding create](https://docs.confluent.io/confluent-cli/current/command-reference/iam/rbac/role-binding/confluent_iam_rbac_role-binding_create.html). You can add up to a soft limit of 1,000 role bindings. For more information, see [RBAC limitations](/platform/current/security/authorization/rbac/overview.html#rbac-limitations). ### Add role assignment form Complete this form to add a role assignment to a cluster or its resources. All fields are required. Some additional fields appear for the resource scope. In addition to assigning roles for a cluster, you can add a role assignment to the following cluster resources, depending on the cluster type: - Apache Kafka® cluster resources: - Consumer Groups - Topics - Transactional IDs - Schema Registry cluster resources: - Subjects - Connect cluster resources: - Connectors The following figure shows the Add role assignment form for a Connect cluster: ![Confluent Platform Add role assignment Connect cluster](images/c3-rbac-add-role-assign-connect-cluster.png) #### Fields Principal type : LDAP/AD Group or User. Principal name : Principal name or ID. You can select an existing principal or create a new principal.
#### IMPORTANT The list of principals is pre-populated with those available from your LDAP/AD environment. If you create a principal rather than select an existing principal, ensure you create a corresponding principal in your LDAP/AD environment. Role : List of available roles depending on the scope context (cluster or cluster resource). Define a scope : Cluster ID or Resource ID. View only.
Pattern type : Literal or Prefixed. For Prefixed, you do not need to enter an asterisk as it is prepended for you. : For a Literal pattern, only a full wildcard is allowed. For example, if you are searching for topics with a certain prefix followed by a wildcard, you must use Prefixed and not Literal.
Select or enter resource ID : Applicable to Resource scopes only (Consumer Group, Topics, Transactional ID, Subject, and Connector).
#### IMPORTANT If a user already has permissions granted to certain prefixes or literal patterns, the list is pre-populated with options for you to select. If you create a resource ID rather than select an existing one from the list, ensure you create a corresponding resource in Confluent Platform. ### Add a role assignment (cluster scope) Follow these steps to add a role assignment (role binding) at the cluster scope level. 1. [Log in](c3-rbac-login.md#c3-rbac-login) to Control Center. 2. From the Control Center **Administration** menu, click **Manage role assignments**. 3. Click the **Assignments** tab. The [Assignments](#c3-rbac-manage-roles-page) page appears. 4. In the **Cluster ID** column, click the underlined link for the cluster name that you want to add role assignments to. Any tabs appropriate for the cluster type appear, open to the Cluster tab by default. 5. Click **+ Add role assignment**. The [Add role assignment form](#c3-rbac-add-role-assign-form) appears. 6. Specify a **Principal type** of either **Group** or **User**. 7. Specify a **Principal name** or **ID**. 8. Select a role from the **Role** list. 9. Click **Save**. The top banner displays the `Successfully created role assignment` message. ### Add a role assignment (resource scope) Follow these steps to add a role assignment (role binding) at the resource scope level. 1. [Log in](c3-rbac-login.md#c3-rbac-login) to Control Center. 2. From the Control Center **Administration** menu, click **Manage role assignments**. 3. Click the **Assignments** tab. 4. In the **Cluster ID** column, click the underlined link for the cluster name that you want to add role assignments to. Any tabs appropriate for the cluster type appear, open to the Cluster tab by default. 5. Navigate to the appropriate cluster resource tab: - Consumer Group, Topic, or Transactional ID (Kafka clusters) - Subject (Schema Registry clusters) - Connector (Connect clusters) 6. Click **+ Add role assignment**. The [Add role assignment form](#c3-rbac-add-role-assign-form) appears. 7. Specify a **Principal type** of either **Group** or **User**. 8. Specify a **Principal name** or **ID**. 9. Select a role from the **Role** list. 10. Complete the fields in the **Define a scope** pane: - Select the **Pattern type** of either **Prefixed** or **Literal**. For Prefixed, you do not need to enter an asterisk as it is prepended for you. For a Literal pattern, only a full wildcard is allowed. For example, if you are searching for topics with a certain prefix followed by a wildcard, you must use Prefixed and not Literal. - Type the **Resource ID** of the resource you are assigning a role to. 11. Click **Save**. The top banner displays the `Successfully created role assignment` message. ## Delete a role assignment Delete a role assignment (role binding) using the Control Center UI. You can delete only one role assignment at a time. You must have an [appropriate role](#c3-rbac-reqd-manage-roles-ui) to delete a role assignment. Deleting a role assignment removes access to a cluster or its resources for a user or group. To use the CLI to delete a role assignment, see [confluent iam rbac role-binding list](https://docs.confluent.io/confluent-cli/current/command-reference/iam/rbac/role-binding/confluent_iam_rbac_role-binding_list.html). ### Delete a role assignment (cluster or resource) Follow these steps to delete a role assignment (role binding) at the cluster or resource scope level. 1. [Log in](c3-rbac-login.md#c3-rbac-login) to Control Center. 2. From the Control Center **Administration** menu, click **Manage role assignments**. 3. Click the **Assignments** tab. The [Assignments](#c3-rbac-manage-roles-page) page appears. 4. In the **Cluster ID** column, click the underlined cluster link for the cluster name that you want to remove access from. 5. If applicable, navigate to the appropriate resource scope page for a cluster, such as: - Consumer Group, Topic, or Transactional ID for a Kafka cluster. - Subject for a Schema Registry cluster. - Connector for a Connect cluster. 6. Depending on which scope: - (Cluster) Select the role assignment to delete in the **Principal name** column. ![Cluster scope delete role assignment](images/c3-rbac-delete-cluster-role-assign.png) - (Resource) Select the role assignment to delete in the **Resource ID** column. ![Resource scope delete role assignment](images/c3-rbac-delete-resource-role-assign.png) 7. Click the trash icon. You are prompted to confirm deleting the role assignment. 8. Type or copy and paste the Cluster or Resource ID into the text box and click **Delete**. The top banner displays `Successfully deleted role assignment.` ![image](images/c3-rbac-delete-role-assign-success.png) ## Troubleshoot role assignments **Issue:** User can add a role assignment successfully in Control Center but cannot view the newly added role assignment. **Reason and remedy:** The user most likely is a broker `super.user` who also has a `ResourceOwner` role. So that user has permissions to create a role assignment but does not have permissions to view or manage the roles. The broker `super.user` should be used to bootstrap the initial `UserAdmin` and `SystemAdmin` roles and users, and not used thereafter.