# CMA Role-based Access Control

CMA uses role-based access control (RBAC) to manage permissions for users. This allows administrators to define what actions users can perform within the CMA components. The security model is implemented through the CMA Auth Server, which runs as a separate service handling authentication and authorization via JWT (JSON Web Tokens).

## Accessing the CMA Auth Server

By default, CMA Auth Server runs on port 9000 and is accessible at _http://localhost:9000_. In parcel deployments, users access CMA through the Gateway Server on port 8090, which proxies authentication requests to the Auth Server.

The server comes pre-configured with a default administrative account `admin:admin` with the full access (`ROLE_CMA_ADMIN` [role](#role-management)). This account has full access to all features and settings within the CMA Auth Server.

![CMA Auth Server Log-in Page](../images/cma_auth_log_in.png)

> **_NOTE:_** It is strongly recommended to change the default password after initial login for security reasons.

## User Management

The CMA Auth Server provides a comprehensive interface for managing users through the **Users** tab in the left navigation panel.

![CMA Auth Server Users Tab](../images/cma_auth_users_tab.png)

From this interface, administrators can:
- Create new users with specific roles
- Modify existing users' details and role assignments
- Delete users who are no longer required
- Reset user passwords

Each user can be assigned one or more roles that determine their permissions within the CMA.

> **_IMPORTANT:_** The system prevents deletion of current user and latest admin user.

## Role Management

Roles define the set of actions a user can perform within CMA. CMA Auth Server comes with predefined roles that cover common use cases:

| Role | Description        | Access Level                                                             |
|------|--------------------|--------------------------------------------------------------------------|
| **ROLE_CMA_ADMIN** | Administrative role | Full access to all features and settings                                 |
| **ROLE_CMA_MIGRATOR** | Migrations role    | Modify access on CMA Server; read access on CMA Auth Server                    |
| **ROLE_CMA_OPERATOR** | Operations role    | Full access on CMA Server; read access on CMA Auth Server |
| **ROLE_CMA_VIEWER** | Viewer role        | Read-only access to content                                              |

To manage roles, navigate to the **Roles** tab in the left navigation panel.

![CMA Auth Server Roles Tab](../images/cma_auth_roles_tab.png)

> **_IMPORTANT:_** The system prevents deletion of roles that are currently assigned to users. To remove a role, you must first remove it from all users.

## Policy Management

Policies in CMA Auth Server define the specific permissions for each resource and action (scope). CMA Auth includes a default set of policies covering all CMA resources and their available actions.

Key characteristics of policies:
- Default policies cover a single resource with a single scope
- Administrators can create custom policies with multiple scopes for specific resources
- Existing policies can be modified or deleted as needed

To manage policies, navigate to the **Policies** tab in the left navigation panel.

![CMA Auth Server Policies Tab](../images/cma_auth_policies_tab.png)

> **_IMPORTANT:_** The system prevents deletion of policies that are currently assigned to roles. To remove a policy, you must first remove it from all roles.

## Client Configuration

CMA Auth Server includes a built-in OAuth2 server that manages authorization for various components within the CMA. You can configure these settings through the **Administration > Clients** section.

![CMA Auth Server Clients Tab](../images/cma_auth_clients_tab.png)

By default, the CMA Auth creates a `cma` client for the CMA Master that handles server authorization. 

### External OAuth2 Integration

CMA Auth Server also supports integration with external OAuth2 providers, with current support for Okta. To configure these integrations, navigate to **Administration > OAuth2 Clients** in the left navigation panel.

## LDAP Configuration

For enterprise environments, CMA Auth Server supports LDAP authentication. This allows users to authenticate using their existing directory credentials.

To configure LDAP:

1. Navigate to the **Administration > LDAP** tab in the left navigation panel
2. Enter your LDAP server details and connection parameters
3. Save changes.
4. Click the **Restart** button to apply changes

![CMA Auth Server LDAP Tab](../images/cma_auth_ldap_tab.png)

> **_NOTE:_** After applying LDAP configuration changes, CMA Auth Server will restart and you will need to sign in again.

