User Management

At the moment, metal-stack can more or less be seen as a low-level API that does not scope access based on projects and tenants. Fine-grained access control with full multi-tenancy support is actively worked on in MEP4.

Until then projects and tenants can be created, but have no effect on access control.

Default Users

The current system provides three default users with their corresponding roles:

• Metal-Admin is an Admin can perform all actions.
• Metal-Edit has the Edit role and may create, edit and delete most resources.
• Metal-Viewer is a Viewer and may only view resources and may access machines.

Each of these users have a corresponding HMAC token, which can be used to authenticate against the API. The tokens do not expire and can be used as long as the service is running. Be cautious with who you share the tokens with.

OIDC

Currently the only way to act as a different user than the default ones, is by using OIDC authentication. Here the OIDC provider decides which role the user has.

Role Mapping

The following table shows which role is required to access the endpoints of the various services at a high level. Only the minimum role required to access the group of endpoints is shown. For the more in-depth documentation of all endpoints, head over to the API documentation.