Role Based Access Controls

ENTERPRISE: Role based access controls are available for Sensu Enterprise users only.

Reference Documentation

• What are Role Based Access Controls for Sensu Enterprise?
  • How does Sensu provide RBAC?
  • Supported RBAC drivers
• RBAC for the Sensu Enterprise Console API
• RBAC configuration
  • Example RBAC definition
  • RBAC definition specification
    • DRIVER attributes
    • roles attributes
    • methods attributes

What are Role Based Access Controls for Sensu Enterprise?

Role-based access controls (RBAC) are a system for restricting access to authorized users according to a role, or job function. RBAC for Sensu Enterprise enables administrators to grant the correct level access to many different development and operations teams, without requiring them to maintain yet another user registry.

How does Sensu provide RBAC?

The Sensu Enterprise Dashboard provides comprehensive and granular Role-Based Access Controls (RBAC), with support for using a Lightweight Access Directory Provider (LDAP), GitHub.com, GitHub Enterprise, and/or GitLab for authentication. Roles can be defined to grant or restrict access to monitoring data based on datacenters, Sensu subscriptions, and even specific API endpoints (see the Enterprise API reference documentation for more information).

Supported RBAC drivers

Sensu Enterprise currently includes the following authentication drivers for RBAC:

• LDAP
• GitHub
• GitLab
• OIDC

RBAC for the Sensu Enterprise Console API

As of Sensu Enterprise Dashboard version 1.12, RBAC configurations may be applied to the Sensu Enterprise Console API. Access to the Sensu Enterprise Console API is controlled by access tokens, which correspond to a role definition (see the roles specification accessToken attribute, below). RBAC for the Console API provides granular controls for restricting access to specific API endpoints and HTTP methods (e.g. it is possible to allow HTTP GET access to the Clients API, but not DELETE access; see the roles specification methods attribute, below).

Providing an access token

In a header:

$ curl -H "Authorization: token TOKEN" https://localhost:3000/events

As a parameter:

$ curl https://localhost:3000/events?token=TOKEN

RBAC configuration

Example RBAC definition

The following is an example RBAC configuration using the RBAC for LDAP authentication driver, a JSON configuration file located at /etc/sensu/dashboard.json.

{
  "dashboard": {
    "host": "0.0.0.0",
    "port": 3000,
    "...": "",
    "ldap": {
      "server": "localhost",
      "port": 389,
      "basedn": "cn=users,dc=domain,dc=tld",
      "binduser": "cn=binder,cn=users,dc=domain,dc=tld",
      "bindpass": "secret",
      "roles": [
        {
          "name": "guests",
          "members": [
            "guests_group"
          ],
          "datacenters": [
            "us-west-1"
          ],
          "subscriptions": [
            "webserver"
          ],
          "readonly": true
        },
        {
          "name": "operators",
          "members": [
            "operators_group"
          ],
          "datacenters": [],
          "subscriptions": [],
          "readonly": false
        }
      ]
    }
  }
}

RBAC definition specification

DRIVER attributes

Role based access controls for Sensu Enterprise are configured within the { "dashboard": { "DRIVER": {} } } configuration scope, where DRIVER is one of the following:

• ldap (see RBAC for LDAP)
• github (see RBAC for GitHub)
• gitlab (see RBAC for GitLab)
• OIDC (see RBAC for OIDC)

roles attributes

Role attributes are defined within the corresponding RBAC DRIVER configuration scope; e.g.: { "dashboard": { "DRIVER": { "roles": [] } } }. The roles attribute is always a JSON array (i.e. "roles": []), containing JSON hashes of role definitions. The following role definition specification is common across all RBAC drivers.

EXAMPLE

{
  "dashboard": {
    "...": "...",
    "ldap": {
      "...": "...",
      "roles": [
        {
          "name": "example_role",
          "members": ["example_group"],
          "datacenters": [],
          "subscriptions": ["example_application"],
          "readonly": false
        }
      ]
    }
  }
}

ATTRIBUTES

"name": "operators"

"members": [
  "myorganization/devs",
  "myorganization/ops"
]

"datacenters": [
  "us-west-1",
  "us-west-2"
]

"subscriptions": [
  "webserver"
]

"readonly": true

openssl rand -base64 40 | tr -- '+=/' '-_~'

"accessToken": "OrIXC7ezuq0AZKoRHhf~oIl-98dX5B23hf8KudfcqJt5eTeQjDDGDQ__"

{
  "name": "readonly_fallback",
  "datacenters": [],
  "subscriptions": [],
  "fallback": true,
  "readonly": true
}

"methods": {
  "head": [
    "none"
  ],
  "get": [],
  "post": [
    "results",
    "stashes"
  ],
  "delete": [
    "stashes"
  ]
}

methods attributes

Sensu Enterprise Console API access controls may be fine tuned using the { "dashboard": { "DRIVER": { "roles": [ { "methods": {} } ] } } } configuration scope.

EXAMPLE

{
  "dashboard": {
    "...": "...",
    "ldap": {
      "...": "...",
      "roles": [
        {
          "name": "example_role",
          "members": ["example_group"],
          "datacenters": [],
          "subscriptions": ["example_application"],
          "accessToken": "j3sJ8itFn9d9ooFYdN9erW3ZN6i8C9V3",
          "methods": {
            "get": [],
            "post": [
              "stashes"
            ],
            "delete": [
              "clients",
              "events"
            ]
          }
        }
      ]
    }
  }
}

SPECIFICATION

"methods": {
  "get": [
    "clients",
    "checks",
    "events"
  ]
}

"methods": {
  "post": [
    "results"
  ]
}

"methods": {
  "delete": [
    "clients",
    "events"
  ]
}

"methods": {
  "head": [
    "clients",
    "checks",
    "events"
  ]
}