-
Notifications
You must be signed in to change notification settings - Fork 1.8k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
1 changed file
with
5 additions
and
18 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,30 +1,17 @@ | ||
When Teleport's Auth Service receives a request to list Teleport Nodes (e.g., to | ||
display Nodes in the Web UI or via `tsh ls`), it only returns the Nodes that the | ||
current user is authorized to access. | ||
current user is authorized to view. | ||
|
||
For each Node in the user's Teleport cluster, the Auth Service applies the | ||
following checks in order and, if one check fails, hides the Node from the user: | ||
|
||
{/* | ||
TODO: We might want to mention that the Auth Service checks the resource's | ||
namespace as well, but we currently do not document resource namespaces. | ||
This would not be the appropriate place to include our only namespace | ||
documentation. See gravitational/teleport issue #12580. | ||
*/} | ||
|
||
- None of the user's roles contains a `deny` rule that matches the Node's labels. | ||
- None of the user's roles contains a `deny` rule that matches the user's | ||
`traits.logins`. | ||
- None of the user's roles contain a `deny` rule that matches the Node's labels. | ||
- None of the user's roles contain a `deny` rule that matches the user's login. | ||
- At least one of the user's roles contains an `allow` rule that matches the | ||
Node's labels. | ||
- At least one of the user's roles contains an `allow` rule that matches the | ||
user's `traits.logins`. | ||
user's login. | ||
|
||
If you are not seeing Nodes when expected, make sure that your user's roles | ||
include the appropriate `allow` and `deny` rules as documented in the | ||
[Teleport Access Controls Reference](/docs/access-controls/reference). | ||
|
||
{/* TODO: Change the link above to a relative MDX file link when remark-includes | ||
supports this. */} | ||
[Teleport Access Controls Reference](../access-controls/reference.mdx). |