Restrict access to specific users and groups

Restrict OpenShift Dev Spaces access to specific users and groups so that you can control which users are allowed or denied access to the platform.

Before you begin

You have an active oc session with administrative permissions to the OpenShift cluster. See This page is not included, but the link has been rewritten to point to the nearest parent document.Getting started with the CLI.

Procedure

Edit the CheCluster Custom Resource to add the advancedAuthorization section:
```
$ oc patch checluster devspaces --type=merge -n openshift-devspaces \
  --patch '{
    "spec": {
      "networking": {
        "auth": {
          "advancedAuthorization": {
            "allowUsers": ["<allow_users>"],
            "allowGroups": ["<allow_groups>"],
            "denyUsers": ["<deny_users>"],
            "denyGroups": ["<deny_groups>"]
          }
        }
      }
    }
  }'
```
where:

allowUsers

List of users allowed to access Red Hat OpenShift Dev Spaces.

allowGroups

List of groups of users allowed to access Red Hat OpenShift Dev Spaces (for OpenShift Container Platform only).

denyUsers

List of users denied access to Red Hat OpenShift Dev Spaces.

denyGroups

List of groups of users denied access to Red Hat OpenShift Dev Spaces (for OpenShift Container Platform only).

If a user is on both allow and deny lists, access is denied. If allowUsers and allowGroups are empty, all users are allowed except the ones on the deny lists. If denyUsers and denyGroups are empty, only the users from allow lists are allowed. If both allow and deny lists are empty, all users are allowed.
Wait for the rollout of the OpenShift Dev Spaces server components to complete.

Results

Log in to the OpenShift Dev Spaces dashboard as a user on the allowUsers list and verify access to the dashboard.
Log in as a user on the denyUsers list and verify that OpenShift Dev Spaces displays the following message:
```
Advanced authorization is enabled. User might not be allowed. Please, contact the administrator.
```