Catalog RBAC

Learn how to configure Catalog RBAC.

Granular RBAC in IDP 2.0 lets you control access to your Catalog entities. You can restrict who creates and views these entities. Catalog entities can be created at all available scopes: Account, Org, or Project. Go to IDP 2.0 Data Model to understand entities, permissions, and scopes.

RBAC workflow in Harness IDP

Before configuring RBAC for your Catalog entities, review Scopes, Permissions, and RBAC components.

This is the workflow for configuring RBAC in Harness IDP:

1. Go to your administrative settings and select the scope (Account, Org, or Project) at which you want to configure RBAC.

2. Create roles with the desired permissions. Example: If you are configuring RBAC for Catalog entity creation, ensure the role has the Create/Edit (Catalog) permission enabled.

3. Create resource groups to apply RBAC to a specific set of resources for the principal. Example: To configure RBAC for Catalog entities, ensure the Catalog resource is added to the resource group.

4. Create user groups and add users.

5. Assign roles and resource groups to users or user groups.

6. If you have not already, configure authentication.

Permissions for catalog entities

All core Catalog entities (Component, API, Resource) fall under the "Catalog" resource category for RBAC. The following permissions can be configured when creating a custom role:

Permission	Description
Create/Edit	Allows users to create Catalog entities and modify their configuration.
View	Allows users to view Catalog entities but not create, modify, or delete them.
Delete	Allows users to delete Catalog entities.

These permissions can be configured when creating a custom role. Select the desired permissions based on the level of access you want to grant. Go to Manage Roles to create and edit roles.

Image

Access through team ownership

A user can view, edit, or delete a Catalog entity through a direct Catalog permission at the entity's scope, or through the same permission on the Team that owns it. Either one is sufficient. However, creating a new entity always requires Catalog Create/Edit permission at the entity's scope and is never inherited from a Team.

Go to Team access control to configure ownership-based access.

Catalog RBAC example

Configure RBAC for Account-level catalog entity creation

This example shows how to configure RBAC to allow full control over Catalog entity creation and modification at the Account scope (including all child resources).

In this example, we use:

• A custom role: IDP Catalog Create

• (Optional) A custom resource group: All Catalog Create Resources

• (Optional) A custom user group: Catalog Create Users

The All Catalog Create Resources group exists at the Account scope and provides Create/Edit access to all Catalog entities across the account, including all organizations and projects. The IDP Catalog Create role includes the Create/Edit permission for Catalog resources.

You can access Administrative Settings from your Harness UI directly using the sidenavbar.

Create the IDP Catalog Create Role

---

Step 1: Create the IDP catalog creator role

Interactive guide

Create the IDP Catalog Create Role

Step-by-step

1. In Harness, go to Account Settings → Roles under the Access Control section.

2. Click New Role to create a new role.

3. Name the role IDP Catalog Create. (Optional: Add a description and tags.)

4. Click Save.

5. Under Permissions → Developer Portal, select:

   • Catalog → Create/Edit

6. Click Apply Changes.

Go to Manage roles | Permissions reference to configure roles and permissions.

---

(Optional) Step 2: Create a custom resource group

Interactive guide

Create the IDP Catalog Create Role

Step-by-step

1. In Harness, go to Account Settings → Resource Groups under Access Control.

2. Click New Resource Group.

3. Name the group All Catalog Create Resources. (Optional: Select a color, description, and tags.)

4. Click Save.

5. For Resource Scope, choose All (including all Organizations and Projects). This grants access to the selected resources across the account, including all orgs and projects. More on Resource Scopes

6. For Resources, select Specified, and then add Catalog from the table.

7. Click Save.

Go to Manage resource groups to create and edit resource groups.

---

(Optional) Step 3: Create the "catalog create users" user group

Interactive guide

Create the IDP Catalog Create Role

Step-by-step

1. In Harness, go to Account Settings → User Groups under Access Control.

2. Click New User Group.

3. Name the group Catalog Create Users. (Optional: Add a description and tags.)

4. Under Add Users, select the users to include in this group.~

5. Click Save.

Go to Manage user groups | Manage users to add users and user groups.

---

Step 4: Assign the role and resource group to the user group

Interactive guide

Create the IDP Catalog Create Role

Step-by-step

1. In Harness, go to Account Settings → User Groups.

2. Find the Catalog Create Users group and click Manage Roles.

3. Under Role Bindings, click Add.

4. For Role, select IDP Catalog Create.

5. For Resource Group, select All Catalog Create Resources.

6. Click Apply.

Go to Role binding to assign roles to users and user groups.

This setup configures RBAC so that users in the Catalog Create Users group have Create/Edit access to Catalog entities at the Account scope, as well as within all Organizations and Projects under the account.