## Configure default permission for ACO users

By default, all users which are authenticated with Openshift (system:authenticated) will be apart of the group `self-provisioners`. This role provides the basic access to create projects etc, where the user then has admin access within.

To prevent this, we must first delete this `self-provisioner` ClusterRoleBinding. Should we ever wish to restore for whatever reason, see the following which is the original contents of the object:

```

kind: ClusterRoleBinding

apiVersion: rbac.authorization.k8s.io/v1

metadata:

  name: self-provisioners

  annotations:

    rbac.authorization.kubernetes.io/autoupdate: 'true'

subjects:

  - kind: Group

    apiGroup: rbac.authorization.k8s.io

    name: 'system:authenticated:oauth'

roleRef:

  apiGroup: rbac.authorization.k8s.io

  kind: ClusterRole

  name: self-provisioner

```

Once removed, a new user which authenticates via ACO, now no longer has permission to do much of anything, beyond what a `basic-user` role provides.

To find this role originally, see resources [1][2]. To list the cluster roles and their bindings do the following `oc describe clusterrole.rbac` and `oc describe clusterrolebinding.rbac`. Searching for `system:authenticated` pointed toward which role was being automatically applied to the users which were authenticated with the cluster.

### Adding permissions to an authenticated user

We first create a group which will contain all the users for a particular proejct. eg:

```

kind: Group

apiVersion: user.openshift.io/v1

metadata:

  name: project-group-admins

users:

  - user2

  - user1

```

Then create a project/namespace for the project. eg: `oc create namespace "project"`

Next create a rolebinding for the group to a role. We want to give members of this group, admin access within the namespace. eg:

```

kind: RoleBinding

apiVersion: rbac.authorization.k8s.io/v1

metadata:

  name: project-admins

  namespace: project

subjects:

  - kind: Group

    apiGroup: rbac.authorization.k8s.io

    name: project-group-admins

roleRef:

  apiGroup: rbac.authorization.k8s.io

  kind: ClusterRole

  name: admin

```

Users listed in the group will now have admin access to the project/namespace and nothing else within the cluster, which is what we want.

### Resources

- [1] Using RBAC to define and apply permissions https://docs.openshift.com/container-platform/4.4/authentication/using-rbac.html#default-roles_using-rbac

- [2] Using OIDC to authenticate https://docs.openshift.com/container-platform/4.4/authentication/identity_providers/configuring-oidc-identity-provider.html#configuring-oidc-identity-provider