Skip to main content

Grant and revoke connector access

Each connector has a connector policy that decides which users can reach it. In the console, you manage a connector's policy by granting directory groups access to it. A connector with no groups is unreachable.

The Connector Gateway evaluates the policy on every request, so a grant or revocation takes effect on the caller's next request.

Grant access to directory groups​

  1. In the console, open the connector and select the Access tab.
  2. Select Add groups.
  3. Select one or more groups, then select Grant access.

Membership is inherited, so granting to a parent group reaches every subgroup beneath it. See Subgroups and inherited membership. Directory groups are separate from the OpenID Connect (OIDC) claim groups that cluster authorization policy matches. See Directory groups and OIDC claim groups.

A group can also hold service accounts, which reach a connector only when its authentication type can serve them, as described in What an account can reach. For any other connector, the Access tab warns which granted groups hold service accounts it can't serve. The people in those groups keep their access.

Revoke a group's access​

  1. On the connector's Access tab, open the actions menu for the group.
  2. Select Revoke access.

The revocation applies immediately, with no confirmation step. Revoking the last group leaves the connector unreachable by anyone.

Cedar-mode connectors​

A connector policy can also be in Cedar mode, where a Cedar policy document decides access instead of group grants. For a Cedar-mode connector, the console shows a notice on the Access tab and disables group editing.

Cedar sees a service account as the same Client principal as a user, with its groups as parents and no token claims. On a connector whose authentication type can serve service accounts, a policy with no condition on the principal, such as permit (principal, action, resource);, admits every active service account, including one in no group. To admit only the members of certain groups, users and service accounts alike, scope the principal to those groups:

permit (principal in UserGroup::"<GROUP_NAME>", action, resource);

<GROUP_NAME> is the group's name in the Enterprise Manager API, which is set when the group is created and can differ from the name the console shows. To admit only users, condition the policy on a token claim, which also denies any user whose token lacks that claim.

Switch modes and write Cedar policy documents through the connector policy routes of the Enterprise Manager API.

Next steps​