Permissions

Permissions determine what operations are allowed on a resource. In Frontier, permissions are represented in the form of service.resource.verb, for example, potato.cart.list.

Permissions often correspond one-to-one with API methods. That is, each service has an associated set of permissions for each API method that it exposes. The caller of that method needs those permissions to call that method. For example, if you want to create a new project you must have the projecr create permission.

You don't grant permissions to users directly. Instead, you identify roles that contain the appropriate permissions, and then grant those roles to the user.

Frontier comes with predefined permissions which allow users to perform common operations on IAM resources itself. For example managing organisation, assigning roles to users.

Permissions in Frontier are attached to a logical partition called Namespace.

Namespace

A Namespace in Frontier is a logical container or partitioning mechanism that helps organize and manage resources and access control policies. It is used to group related entities and define the scope of authorization within a system. With the namespaces we compartmentalize and control access to different parts of the application or system, allowing more granular authorization and improved security.

Each namespace can have its own set of permissions, roles, and access control policies, enabling fine-grained control over who can access what resources within the defined scope. For example, the namespace app/organization in Frontier contains permissions related to managing organizations. These permissions could include create update delete get and so on.

Predefined Org Permissions

Includes a list of Frontier's predefined permissions at the organization level.

Frontier allows inheritance of permissions for a hierarchical structure, where higher-level permissions grant access to lower-level entities. In this case, granting permissions at the organization level automatically extends those permissions to the projects, resources, and groups within that org.

Permission Name	Permission Title	Description
*`app.organization.administer`*	`Organization Administer`	Grants administrative privileges for managing the organization.
*`app.organization.delete`*	`Organization Delete`	Allows deleting the organization.
*`app.organization.update`*	`Organization Update`	Allows updating or modifying the organization's information.
*`app.organization.get`*	`Organization Get`	Allows retrieving or accessing a specific organization.
*`app.organization.rolemanage`*	`Organization Role Manage`	Enables managing or controlling roles within the organization.
*`app.organization.policymanage`*	`Organization Policy Manage`	Enables managing or controlling access control policies within the organization.
*`app.organization.projectlist`*	`Organization Project List`	Allows listing or retrieving a list of projects within the organization.
*`app.organization.grouplist`*	`Organization Group List`	Allows listing or retrieving a list of groups within the organization.
*`app.organization.invitationlist`*	`Organization Invitation List`	Allows listing or retrieving a list of user invitations in the organization.
*`app.organization.projectcreate`*	`Organization Project Create`	Allows creating new projects within the organization.
*`app.organization.groupcreate`*	`Organization Group Create`	Allows creating new groups within the organization.
*`app.organization.invitationcreate`*	`Organization Invitation Create`	Allows creating new invitations or access requests within the organization.
*`app.organization.serviceusermanage`*	`Organization Service User Manage`	Enables managing or creating service users within the organization.
*`app.organization.billingmanage`*	`Organization Billing Manage`	Enables managing billing related information and purchases for the organization.
*`app.organization.billingview`*	`Organization Billing View`	Enables viewing billing related information and purchases for the organization.

Predefined Project Permissions

Includes a list of Frontier's predefined permissions at the project level.

Permission Name	Permission Title	Description
*`app.project.administer`*	`Project Administer`	Grants administrative privileges for managing the project.
*`app.project.delete`*	`Project Delete`	Allows deleting the project.
*`app.project.update`*	`Project Update`	Allows updating or modifying the project's information.
*`app.project.get`*	`Project Get`	Allows retrieving or accessing a specific project.
*`app.project.policymanage`*	`Project Policy Manage`	Enables managing or controlling access control policies within the project.
*`app.project.resourcelist`*	`Project Resource List`	Allows listing or retrieving a list of resources within the project.

Predefined Group Permissions

Contains a list of Frontier's predefined permissions at the group level.

Permission Name	Permission Title	Description
*`app.group.administer`*	`Group Administer`	Grants administrative privileges for managing the group.
*`app.group.delete`*	`Group Delete`	Allows deleting the group.
*`app.group.update`*	`Group Update`	Allows updating or modifying the group's information.
*`app.group.get`*	`Group Get`	Allows retrieving or accessing a specific group.

Permissions in Frontier follow a hierarchical structure, where higher-level permissions include the capabilities of lower-level permissions. For example, a higher-level permission like adminiter includes all the capabilities of a lower-level permission like get.

Custom Permissions

Frontier allow the its platform administrators (Superusers) to create permissions to meet specific authorization requirements beyond the predefined set of permissions. Custom permissions allow for more granular control over access to resources and actions within an application or system. They enable organizations to define and enforce fine-grained access policies tailored to their unique needs.

When creating a custom permission, an administrator gives it a key in the form service.resource.verb. The key names the service, the resource the permission acts on, and the action it grants. For example, potato.cart.delete grants the delete action on the cart resource of the potato service.

Custom permissions are created through the reconcile flow (a kind: Permission desired-state file) or through the CreatePermission admin API. The older way of listing them in the server config file has been removed.

For example, let's say you have an e-commerce application where users can manage their shopping carts. To control access to cart-related actions, you can create custom permissions for the cart resource.

Sample custom permission requirements:

Key	Permission Title	Description
`potato.cart.delete`	Cart Delete	Grants the ability to delete items from the shopping cart.
`potato.cart.update`	Cart Update	Allows updating the contents of the shopping cart.
`potato.cart.get`	Cart Get	Enables retrieving the details of the shopping cart.

This is how the desired-state file for these permissions looks:

apiVersion: v1
kind: Permission
spec:
  - key: potato.cart.delete
  - key: potato.cart.update
  - key: potato.cart.get

Frontier turns a permission key into a slug by replacing the dots with underscores. So potato.cart.delete becomes the slug potato_cart_delete. When you create a role, you bind it to these permission slugs.

Managing Permission

Some of these APIs require special privileges to access these endpoints and to authorize these requests, users may need a Client ID/Secret or an Access token to proceed. Read Authorization for APIs to learn more.