Managing Roles and Permissions

By default, when a cluster starts, the “super admin” REST user identity is created, which has unrestricted access permissions. This user is created using a special utility that performs a one-time write to the RBAC permissions database. This “super admin” user can create additional users and assign necessary permissions to them. These permissions may include, but are not limited to, the ability to create even more users. A user with permission to create other users cannot assign more permissions other users than it currently has itself.

RBAC permission templates enable you to create fine-grained roles for specific actions such as:

• A dedicated role which can create users, roles, and permissions and drive all the associations between them.
• A dedicated role with a set of all the necessary permissions to create a virtual node The combination of the context of a user and the ephemeral compute instances created to progress a transaction on that identity's behalf. (including CPI Corda Package Installer. A signed ZIP/JAR combination of a CPB and a Group Policy File that defines not only the application code that a virtual node will run, but also the details of the MGM with which to register, and the details of network PKI requirements. upload).
• A dedicated role which allows flows to run on this virtual node.

Default Roles

The following table lists the roles created by default by RBAC bootstrapping as part of deploying Corda. For information about creating roles manually, see the Manual Bootstrapping section.