4.8 KiB
| title | description | keywords |
|---|---|---|
| Create and manage teams | Learn how to create and manage user permissions, using teams in your Docker Universal Control Plane cluster. | authorize, authentication, users, teams, groups, sync, UCP, Docker |
You can extend the user's default permissions by granting them fine-grained permissions over resources. You do this by adding the user to a team.
To create a new team, go to the UCP web UI, and navigate to the Organizations page.
{: .with-border}
If you want to put the team in a new organization, click Create Organization and give the new organization a name, like "engineering". Click Create to create it.
In the list, click the organization where you want to create the new team. Name the team, give it an optional description, and click Create to create a new team.
{: .with-border}
Add users to a team
You can now add and remove users from the team. In the current organization's teams list, click the new team, and in the details pane, click Add Users. Choose the users that you want to add to the team, and when you're done, click Add Users.
{: .with-border}
Sync team members with your organization's LDAP directory
Beta version of Docker EE
In the public Beta version of Docker EE, you can't use the UCP web UI to integrate with LDAP. Instead, you need to use a UCP configuration file.
If UCP is configured to sync users with your organization's LDAP directory server, you will have the option to enable syncing the new team's members when creating a new team or when modifying settings of an existing team. Learn how to configure integration with an LDAP directory. Enabling this option expands the form with additional fields for configuring the sync of team members.
{: .with-border}
There are two methods for matching group members from an LDAP directory:
Match LDAP Group Members
This option specifies that team members should be synced directly with members of a group in your organization's LDAP directory. The team's membership will by synced to match the membership of the group.
| Field | Description |
|---|---|
| Group DN | This specifies the distinguished name of the group from which to select users. |
| Group Member Attribute | The value of this group attribute corresponds to the distinguished names of the members of the group. |
Match LDAP Search Results
This option specifies that team members should be synced using a search query against your organization's LDAP directory. The team's membership will be synced to match the users in the search results.
| Field | Description |
|---|---|
| Base DN | The distinguished name of the node in the directory tree where the search should start looking for users. |
| Search subtree instead of just one level | Whether to perform the LDAP search on a single level of the LDAP tree, or search through the full LDAP tree starting at the Base DN. |
| Filter | The LDAP search filter used to find users. If you leave this field empty, all existing users in the search scope will be added as members of the team. |
Sync Now
Select this option to immediately run an LDAP sync operation after saving the configuration for the team. It may take a moment before the members of the team are fully synced.
Manage team permissions
Create a grant to manage the team's permissions. Learn how to grant permissions to users based on roles.
{: .with-border}
In the example above, members of the Data Center team have
Restricted Control permissions to create and edit resources in
the Data Center Resources collection.