Access control

Default roles

TCM comes with default roles that cover three common usage scenarios:

• Super Admin Role is a default role with all available administrative permissions. Additionally, the users with this role automatically gain all cluster permissions to all clusters.
• Cluster Admin Role is a default role for cluster administration. It includes administrative permissions for cluster management.
• Default User Role is a default role for working with clusters. It includes basic administrative read permissions that are required to log in to TCM and navigate to a cluster.

Managing roles

Administrators can create new roles, edit, and delete existing ones.

Roles are listed on the Roles page.

To create a new role, click Add, enter the role name, and select the permissions to include in the role.

To edit an existing role, click Edit in the Actions menu of the corresponding table row.

To delete a role, click Delete in the Actions menu of the corresponding table row.

Default admin

There is one default user Default Admin. It has all the available permissions, both administrative and cluster ones. When new clusters are added in TCM, Default Admin automatically receives all cluster permissions for them as well.

Managing users

Administrators can create new users, edit, and delete existing ones.

The tools for managing users are located on the Users page.

To create a user:

1. Click Add.
2. Fill in the user information: username, full name, and description.
3. Generate or type in a password.
4. Select roles to assign to the user.
5. Add clusters to give the user access to, and select cluster permissions for each of them.

To edit a user, click Edit in the Actions menu of the corresponding table row.

To delete a user, click Delete in the Actions menu of the corresponding table row.

Changing your password

To change your own password, click your name in the top-right corner and go to Settings > Change password.

Changing users’ passwords

Administrators can manage a user’s password on this user’s Secrets page. To open it, click Secrets in the Actions menu of the corresponding Users table row.

To change a user’s password, click Edit in the Actions menu of the corresponding Secrets table row and enter the new password in the New secret key field.

Password expiry

Passwords expire automatically after the expiration period defined in the password policy. When a user logs in to TCM with an expired password, the only action available to them is a password change. All other TCM functions and objects are unavailable until the new password is set.

Administrators can also set users’ passwords to expired manually. To set a user’s password to expired, click Expire in the Actions menu of the corresponding Secrets table row.

Blocking passwords

To forbid users’ access to TCM, administrators can temporarily block their passwords. A blocked password can’t be used to log into TCM until it’s unblocked manually or the blocking period expires.

To block a user’s password, click Block in the Actions menu of the corresponding Secrets table row. Then provide a blocking reason and enter the blocking period.

To unblock a blocked password, click Unblock in the Actions menu of the corresponding Secrets table row.

Password policy

Password policy helps improve security and comply with security requirements that can apply to your organization.

You can edit the TCM password policy on the Password policy page. There are the following password policy settings:

• Minimal password length.
• Do not use last N passwords.
• Password expiration in days. Users’ passwords expire after this number of days since they were set. Users with expired passwords lose access to any objects and functions except password change until they set a new password.
• Password expiration warning in days. After this number of days, the user sees a warning that their password expires soon.
• Block after N login attempts. Temporarily block users if they enter their username or password incorrectly this number of times consecutively.
• User lockout time in seconds. The time interval for which users can’t log in after spending all failed login attempts.
• Password must include. Characters and symbols that must be present in passwords:
  • Lowercase characters (a-z)
  • Uppercase characters (A-Z)
  • Digits (0-9)
  • Symbols (such as !@#$%^&*()_+№”’:,.;=][{}`?>/.)

Administrative permissions

The following administrative permissions are available in TCM:

Cluster permissions

The following cluster permissions are available in TCM: