Authorization roles & permissions

Community Support
,
1

Hi,

I have two questions.

  1. What is the limitations of each role on temporal web / server level, please describe me?
  • RoleReader
  • RoleWriter
  • RoleAdmin
  • RoleWorker
  1. Among of four temporal services (frontend, worker, metrics & history) which services gives the metrics in Prometheus?
2

  1. The roles are mostly open-ended placeholders at this point to allow for free interpretation of them by custom authorizers.
    The only exception is defaultAuthorizer uses definitions of read-only APIs.

  2. All of the services emit metrics.

3

Do we have a seperate tctl cli authorization?
Can u pls share examples for tctl authorization & claim mapper?

4

@tihomir

I am not sure @SergeyBykov is in Active Employee or left firm.

Can you please share the below information or redirect to right person.

As per Reader user can get access to set of the api as mentioned definitions of read-only APIs.

Do you have any standard template for each role limited to have set of the apis (ex., reader, writer & admin)?