Role-Based Access Control (RBAC)

This guide provides an overview of Role-Based Access Control (RBAC) and its features in OpenObserve.

Overview

OpenObserve uses RBAC to manage what actions users can perform based on their assigned roles. Instead of giving all users the same level of access, RBAC ensures that each user can only access the features and data relevant to their role.

How OpenObserve Implements RBAC

OpenObserve uses OpenFGA, an authorization system, to manage role-based access control.

Workflow

1. OpenObserve sends API requests to the OpenFGA server to store and retrieve RBAC-related data.
2. The OpenFGA server maintains role relationships and permissions in a database.
3. When a user attempts to perform an action, OpenObserve queries OpenFGA to check whether the action is allowed.
4. OpenFGA evaluates the role relationships and returns a true or false response:
   True: The user can perform the action.
   False: The user cannot perform the action.

RBAC in OpenObserve

RBAC in OpenObserve is managed through the Identity and Access Management (IAM) panel, which provides features for administering users, roles, service accounts, and user groups.

Permissions

RBAC permissions define what actions users can perform:

• List: View records without modification.
• Get: Retrieve specific details of a resource.
• Create: Add new resources.
• Update: Modify existing resources.
• Delete: Remove resources.

Roles

Predefined User Roles

OpenObserve provides the following predefined roles:

• Admin: Full access to all settings and data, including user management.
• Editor: List, get, create, update, and delete access. Cannot manage users.
• Viewer: Read-only access. No create, update, or delete permissions.
• User: No access. Receives an "Unauthorized Access" warning upon login.

Note: The Root User is the highest-privileged account in OpenObserve with full access across all organizations. Each OpenObserve installation has one root user, created during setup by providing the email and password as environment variables.

Custom User Roles

Admins can create custom user roles in OpenObserve to define more granular access policies.

To create a custom role:

1. Go to the IAM panel and select the Roles section.
2. Click the New role button.
3. Enter the custom role name. Use only alphanumeric characters (A-Z, a-z, 0-9) and underscores (_). Spaces are not allowed. Custom role names must not match predefined roles such as Admin, Editor, Viewer, or User.
4. Optionally, pick a preset in Start from, such as Read-only (view access to all resources), to pre-select permissions. The default is Custom (empty role).
5. Click Save.
6. Click the edit icon on the custom role. Use the Permissions tab to grant access per module, and the Users and Service Accounts tabs to assign members.
7. Click Review Changes to check pending changes, then click Save.

LLM Evaluations (AI Observability) Permissions

OpenObserve also supports fine-grained RBAC for LLM Evaluations (AI Observability) resources. When you edit a custom role, these resources appear as modules in the AI group of the module list, alongside other modules such as streams, dashboards, and folders:

• LLM Providers: Control access to the LLM providers used for AI evaluations.
• Score Configs: Control access to scoring configurations.
• Scorers: Control access to scorers, such as an LLM judge.
• Online Eval Jobs: Control access to online evaluation jobs.

Each of these resources supports entity-level permissions, so you can grant access to a specific provider, scorer, score config, or eval job rather than every entity of that type.

To grant access to a specific LLM evaluation entity:

1. From the IAM panel, select Roles and click the edit icon on a custom role.
2. In the permission list, select the resource you want to restrict, for example LLM Providers.
3. Choose the specific entities to grant access to from the entity list.

List views respect these permissions: when a user lists providers, score configs, scorers, or eval jobs, OpenObserve returns only the entities the user is permitted to view.

Service Accounts

A service account in OpenObserve is a non-human account used for API access, automation, and integrations. Each service account is assigned a token for authentication.

• Enterprise and Cloud versions: Service accounts have no permission by default. Admins must assign roles to the service accounts explicitly.
• Open-source version: Service accounts have full access by default.

To add a service account:

1. From the IAM panel, select Service Accounts.
2. Click New service account.
3. Enter the Service account name (lowercase letters, numbers and hyphens), and optionally pick roles and user groups.
4. Click Save.
5. A token is generated for the service account and shown once.
6. If you did not pick roles or groups, assign the necessary roles and permissions. See Service Accounts. This step is required for the service account to make API calls and access specific services in OpenObserve.

Note:

• You can generate a new token at any time with Rotate Token in the service account's row on the Service Accounts page.
• Ensure that the assigned roles provide only the minimum required access based on the use case.

User Groups

User groups allow admins to manage permissions collectively.

To add user groups:

1. From the IAM panel, select the User Groups section.
2. Click the New user group button, add a group Name, and click Save.
3. To add users to the group and assign roles, click the edit icon.
4. From the Roles, Users, and Service Accounts tabs, select the list of users and service accounts that need to be assigned with appropriate roles.
5. Click Save.

Users

Users are organization members with assigned roles that determine their access and actions within OpenObserve. Their permissions depend on the role assigned to them, such as Admin, Editor, Viewer, User, or Root User.

Note: Only the root user and Admin users can add users to an organization. With RBAC enabled, roles that have the matching Users permission can also add them.

To add a user to an organization:

1. Navigate to IAM > Users.
2. Click New user.
3. Enter the user’s email address.
   
4. Select one of the predefined roles- Admin, Editor, Viewer, or User.
5. Optionally, assign one or more custom roles to extend permissions.
6. Click Save.
7. If the user does not already exist, you will be prompted to set a password, first name, and last name.
   If the entered email address already belongs to an existing user, the system will show a message: User is already part of the organization.
   

After you save the changes, the new user gets listed in the Users page.
Use the Actions column to edit and delete the user.

Note: In the Cloud version, Admin and root users click Invite members, enter email addresses separated by commas or semicolons, select a role, and click Send invites.