Enable Enhanced RBAC on the Turbine Platform (On-Prem)

enable enhanced rbac on a turbine platform installed with the turbine platform installer (tpi), version 26 4 or later a super admin user ( issuperadmin is true ) turns the flags on account admin users on the same account assign roles and groups an account admin cannot change these flags product behavior after the switch is described in enhanced role based access control (rbac) https //docs swimlane com/90kk role based access control rbac cloud customers request the switch through support see move from legacy rbac to enhanced rbac https //docs swimlane com/move from legacy rbac to enhanced rbac this page is the on premises self serve procedure choose your path goal where to go run the first time migration run the first time migration docid 425j7 bk kfvbuqminud roll back to legacy rbac roll back to legacy rbac docid 425j7 bk kfvbuqminud turn enhanced rbac back on without a new migration turn enhanced rbac back on docid 425j7 bk kfvbuqminud re migrate after legacy role changes re migrate and switch on again docid 425j7 bk kfvbuqminud see what each flag does quick flag map docid 425j7 bk kfvbuqminud for a first time switch, enable enhancedrbacdatamigration only do not turn on enhancedrbac yourself after a successful migration, the platform turns enhancedrbac on automatically do not enable enhancedrbacdatamigration more than once without a pause wait until the migration job succeeds several enable attempts in a row can cause migration failures users with no permissions cannot log in after enhanced rbac is on before you start, confirm each user who must log in has a role see who can log in after the switch docid 425j7 bk kfvbuqminud migration copies legacy roles, groups, and users into the identity database ( turbineidentity ) it assigns super admin users to the seeded super admin role and account admin users to the seeded account admin role before migration take a platform snapshot https //docs swimlane com/turbine installer/turbine platform installer guide before you start log in as super admin and collect the account id curl ss x post "https //\<turbine host>/tenant/api/users/login" \\ h "content type application/json" \\ h "accept application/json" \\ d '{"username" "\<super admin email>","password" "\<password>"}' from the response, copy token confirm useraccountaccessmodels issuperadmin is true and useraccountaccessmodels isswimlaneuser is true useraccountaccessmodels accountid is the swimlane account id ( swimlane account id ) use it in the requests below run the first time migration enable only enhancedrbacdatamigration the put publishes a feature flag enabled event the identity rbac migration service copies legacy roles, groups, users, and permissions into the identity database ( turbineidentity ) it also assigns super admin and account admin users to the seeded identity roles on success, it enables enhancedrbac automatically for what each flag does, see quick flag map docid 425j7 bk kfvbuqminud curl ss x put \\ "https //\<turbine host>/tenant/api/feature flag/\<swimlane account id>/enhancedrbacdatamigration?enabled=true" \\ h "authorization bearer \<token>" \\ h "accept application/json" watch the migration pod export ns=default kubectl n $ns logs l app=identity rbac migration tail=200 f success looks like rbac consumer received feature flag event enhancedrbacdatamigration for account \<swimlane account id> starting rbac migration / successfully completed rbac migration enabling the 'enhancedrbac' feature flag on \<swimlane account id> failure looks like rbac migration failed or starting cleanup process on failure, the migration process deletes partial identity data for that account enhancedrbac must stay off do not retry until you have those logs confirm both account level flags are true curl ss "https //\<turbine host>/tenant/api/feature flag/\<swimlane account id>" \\ h "authorization bearer \<token>" \\ h "accept application/json" then log in again as super admin, so the super admin role is in the session log in as a user with the account admin role log in as a non admin user access should match what those users had in legacy rbac users with no role cannot log in users whose only role has no permissions, on an account that was already on enhanced rbac, cannot log in see who can log in after the switch docid 425j7 bk kfvbuqminud who can log in after the switch legacy rbac and enhanced rbac treat users with no access differently legacy rbac a user with no role can still log in they can change only their own user profile they cannot use the rest of the product enhanced rbac a user with no permissions cannot log in permissions come from roles a user can have a role assigned directly, or through a group that has the role to log in, the user needs at least one account level permission, from a role assigned to the user or to one of the user's groups see enhanced role based access control (rbac) https //docs swimlane com/90kk role based access control rbac account still on legacy rbac a role with no permissions is enough to log in migration recreates existing roles https //docs swimlane com/move from legacy rbac to enhanced rbac in enhanced rbac it also adds the account level read permissions that legacy granted silently, including users → read and groups → read those permissions are enough to log in after the switch account already on enhanced rbac if no role grants at least one permission on the roles page, select create role grant at least one permission a role with no permissions does not allow login an account level permission (for example users → read ) is enough you do not need to grant tenant permissions for the user to log in roll back to legacy rbac turn enhanced rbac off for the swimlane account ( swimlane account id ) disabling enhancedrbac returns that account to the legacy rbac role configuration from before migration changes made on the enhanced rbac roles page are not copied back leave enhancedrbacdatamigration on unless you plan to re migrate later disable enhanced rbac with the api use this path when a super admin can still call the api curl ss x put \\ "https //\<turbine host>/tenant/api/feature flag/\<swimlane account id>/enhancedrbac?enabled=false" \\ h "authorization bearer \<token>" \\ h "accept application/json" confirm enhancedrbac is false log in again and confirm the legacy rbac roles page disable enhanced rbac in the database use this path when the api is blocked and users are locked out use the same $ns as in run the first time migration docid 425j7 bk kfvbuqminud update the account level row in swimlanetenant do not update the global row ( "accountid" is null ) kubectl n $ns exec it postgresql 0 bash su postgres psql \c swimlanetenant inspect the flags the swimlane account row has a null "tenantid" and the account id in "accountid" select "id", "name", "accountid", "tenantid", "enabled", "isdisabled" from public "featureflags" where "name" in ('enhancedrbac', 'enhancedrbacdatamigration') order by "name", "accountid" nulls first; disable enhancedrbac for swimlane account id update public "featureflags" set "enabled" = false, "modifieddatetime" = now(), "isdisabled" = false where "name" = 'enhancedrbac' and "accountid" = '\<swimlane account id>' uuid and "tenantid" is null; select "name", "accountid", "enabled" from public "featureflags" where "name" = 'enhancedrbac' and "accountid" = '\<swimlane account id>' uuid and "tenantid" is null; a direct sql update does not clear the in memory flag cache wait up to two minutes , or restart the services that read the flag kubectl n $ns rollout restart deployment swimlane tenant swimlane api identity api then confirm that users can log in and that the legacy rbac roles page is back do not enable enhancedrbacdatamigration with sql that write does not publish the event, so migration will not start re enable enhanced rbac the choice is the same as in move from legacy rbac to enhanced rbac https //docs swimlane com/move from legacy rbac to enhanced rbac use swimlane account id turn enhanced rbac back on use this when you rolled back by turning enhancedrbac off and you do not need to copy later legacy role changes into enhanced rbac enhancedrbacdatamigration should already be true enable only the runtime flag curl ss x put \\ "https //\<turbine host>/tenant/api/feature flag/\<swimlane account id>/enhancedrbac?enabled=true" \\ h "authorization bearer \<token>" \\ h "accept application/json" this does not run migration again users get the enhanced rbac configuration that existed when enhanced rbac was switched off legacy rbac role edits made while the account was on legacy rbac are ignored re migrate and switch on again use this when legacy roles changed after rollback and you want identity rebuilt from current legacy data if enhancedrbac is still on, turn it off use disable enhanced rbac with the api docid 425j7 bk kfvbuqminud or disable enhanced rbac in the database docid 425j7 bk kfvbuqminud stay on legacy rbac during re migration turn enhancedrbacdatamigration off turn enhancedrbacdatamigration on migration starts when the flag changes from false to true curl ss x put \\ "https //\<turbine host>/tenant/api/feature flag/\<swimlane account id>/enhancedrbacdatamigration?enabled=false" \\ h "authorization bearer \<token>" \\ h "accept application/json" curl ss x put \\ "https //\<turbine host>/tenant/api/feature flag/\<swimlane account id>/enhancedrbacdatamigration?enabled=true" \\ h "authorization bearer \<token>" \\ h "accept application/json" watch identity rbac migration logs the same way as for first time enablement on success, enhancedrbac is turned on again re migration updates roles by legacy id and refreshes role permissions a rare mismatch can appear when all of the following are true the account was migrated once the account was returned to legacy rbac a role from the first migration was deleted a new role was created with the same name if that happens, fix or recreate the affected role after migration if re migration fails, the migration process deletes identity data for that account enhancedrbac must stay off fix the error, then repeat the off to on toggle of enhancedrbacdatamigration quick flag map flag scope what it does how to set enhancedrbacdatamigration account ( swimlane account id ) starts or restarts identity migration does not switch the ui or enforcement by itself on the swimlane account, also assigns super admin and account admin users to the seeded identity roles api put enabled=true the flag must change from false to true sql does not start migration enhancedrbac account ( swimlane account id ) switches enforcement and the roles page to enhanced rbac the platform enables this flag after a successful migration first time do not set this flag rollback put or sql enabled=false re enable without a re migration put enabled=true