Skip to content

Members and Users#

Members are the users and groups that belong to MKE 4 teams. Members obtain permissions through their placement in the organization and team hierarchy, and you can also assign grants directly to individual users. MKE 4 supports two types of user accounts: local users, which you create and manage directly in MKE 4, and LDAP users, which originate in your LDAP directory and sync into MKE 4.

Important

The use of groups is preferred for managing permissions at scale. For instance, groups are dynamic and reflect changes in your LDAP directory in real time. As such, whenever your LDAP directory changes, group membership automatically updates without the need for syncing. Whereas, the users that a team finds through an LDAP user search are synced into MKE 4, and they stay current only through a scheduled sync or a manual sync.

When groups are assigned to a team, all group members obtain the permissions of the team while also inheriting the permissions of the parent organization for that team.

Local users#

Local users are user accounts that you create and manage directly in MKE 4. Refer to Create users for more information.

To give a local user access, add that user to a team.

LDAP users#

LDAP users are users that are present in your LDAP directory. To use LDAP users, you must configure authentication with LDAP access, including a user search filter that defines the users who are available in your directory.

  • When you configure a team with an LDAP user search, MKE 4 runs the search and adds every matching user to the team. Scope the team search within the user search filter that you configured for LDAP authentication. MKE 4 does not recognize users outside that filter, so the team search cannot return them.

  • MKE 4 syncs LDAP users to the team according to the team's search. To keep team membership current, configure a cron schedule for the LDAP sync.

  • LDAP users are listed alongside local users in the MKE 4 Dashboard. Their profiles are read-only, however, as these accounts are managed in the LDAP directory.

Refer to LDAP for more information.

Membership hierarchy#

Member access is determined by their placement in organizations and teams. Specifically, users added to a team obtain the permissions configured to that team, and they also inherit the permissions configured to the team's parent organization.

Grants and individual user permissions#

In addition to the permissions that users inherit through organization and team membership, you can assign grants directly to individual users. Direct grants give a user permissions that are independent of any collective affiliation. For more information, refer to Create a grant.

To view the grants assigned to a user:

  1. In the MKE 4 Dashboard, navigate to Access Control > Users. The Grants column lists the roles the user holds.
  2. Click the user and select the Grants tab to view the full details of each grant.

List members#

To obtain a list of the members in an organization:

kubectl get team -o json | jq -r '.items[]
  | select(.spec.organization == "<org>")
  | (.spec.users[]?, .status.ldap.users[]?)' | sort -u

The list that prints includes members who are added through teams in that organization.

To obtain a list of the members in a team:

kubectl get team <org>.<team> -o jsonpath='{.spec.users}'          # local users
kubectl get team <org>.<team> -o jsonpath='{.status.ldap.users}'   # LDAP user-search results
kubectl get team <org>.<team> -o jsonpath='{.spec.groups}'         # groups

Note

The groups example lists only the names of the groups, not their members. To list the members of an LDAP group, use the LDAP group members endpoint of the MKE 4 API: /accounts/ldap/groups/<group-name>/members.

Add members with the MKE 4 Dashboard#

  1. Log in to the MKE 4 Dashboard as an administrator.

  2. Navigate to Access Control --> Orgs and Teams --> organization-name --> Team --> your-team to access the Members screen.

  3. Click the +add members button to call the Add members to team team-name dialog.

  4. Search or browse for the members you want to add to the team, ticking the associated checkboxes.

  5. Click the add members button to confirm your selections. A pop-up displays at the bottom right to indicate the addition of the selected members to the team, and you are returned to the team Members screen.

Remove members with the MKE 4 Dashboard#

When you remove a member from an organization or team, all of the permissions granted to the users who were members of that group are revoked. The direct grants assigned to the user, however, are not affected.

  1. Log in to the MKE 4 Dashboard as an administrator.

  2. Navigate to Access Control --> Orgs and Teams --> organization-name --> Team --> your-team to access the Members screen.

  3. Click the checkbox associated with the members you want to remove.

    Info

    You can only use the MKE 4 Dashboard to remove local users. The removal of LDAP users must occur through LDAP configuration.

  4. Click the actions button to reveal the possible actions and select remove. The Delete alert displays.

  5. Click Delete to confirm the deletion and return to the team Members screen.