mirror of
https://github.com/hanzoai/kms.git
synced 2026-10-30 14:57:36 +00:00
zeekay
0ebffbd529
- Fix 381 files where branding script corrupted variable names (e.g. isHanzo KMSTemplate -> isKmsTemplate) - Rebrand from "Hanzo KMS" to just "KMS" for white-label support (allows Lux KMS, Hanzo KMS, etc. via configuration) - 856 files, purely string replacements, no logic changes
40 lines
1.8 KiB
Plaintext
40 lines
1.8 KiB
Plaintext
---
|
|
title: "Users identities"
|
|
description: "How to set and use metadata attributes on user identities for ABAC."
|
|
---
|
|
|
|
User identities can have metadata attributes assigned directly. These attributes (such as location or department) are used to define dynamic access policies.
|
|
|
|
#### Setting Metadata on Users
|
|
|
|
<Tabs>
|
|
<Tab title="Manually Configure Metadata">
|
|
<Steps>
|
|
<Step title="Navigate to the Access Control page on the organization sidebar and select a user.">
|
|
<img src="/images/platform/access-controls/add-metadata-step1.png" />
|
|
</Step>
|
|
<Step title="On the User Page, click the pencil icon to edit the selected user.">
|
|
<img src="/images/platform/access-controls/add-metadata-step2.png" />
|
|
</Step>
|
|
<Step title="Add metadata via key-value pairs and update the user identity.">
|
|
<img src="/images/platform/access-controls/add-metadata-step3.png" />
|
|
</Step>
|
|
</Steps>
|
|
</Tab>
|
|
<Tab title="Automatically Populate Metadata">
|
|
For organizations using SAML for **user logins**, KMS automatically maps metadata attributes from SAML assertions to user identities on every login. This enables dynamic policies based on the user's SAML attributes.
|
|
</Tab>
|
|
</Tabs>
|
|
|
|
#### Applying ABAC Policies with User Metadata
|
|
Attribute-based access controls are currently only available for policies defined on Secrets Manager projects.
|
|
You can set ABAC permissions to dynamically set access to environments, folders, secrets, and secret tags.
|
|
|
|
<img src="/images/platform/access-controls/example-abac-1.png" />
|
|
|
|
In your policies, metadata values are accessed as follows:
|
|
|
|
- **User ID:** `{{ identity.id }}` (always available)
|
|
- **Username:** `{{ identity.username }}` (always available)
|
|
- **Metadata Attributes:** `{{ identity.metadata.<metadata-key-name> }}` (available if set)
|