Manage access to Endor Labs

Learn how to manage access user and machine access to Endor Labs.

Endor Labs comes with a built in attribute based access control system. Attribute-based access control (ABAC) is an authorization model that evaluates attributes (or the characteristics of an identity), rather than roles, to determine access.

Endor Labs uses external identity providers to authenticate all users and the attributes associated with the identity to authorize them.

Configure authorization with Endor Labs

Authorization in Endor Labs is defined by a set of authorization policies. Authorization policies define the permissions provided to an identity authenticated by a supported identity provider when that identity meets specific rule criteria defined as attributes or claims about the identity.

Authorization policies must contain the following information:

  • The supported identity provider through which a given identity comes from.
  • The permissions provided to an identity when specific rule criteria are met.
  • An optional expiration time for the policy
  • The rule criteria or claims for which the identity must have in order to be authorized to access Endor Labs.
  • After setting up the authorization policy, you can invite users to Endor Labs

Authorization policy roles

Endor Labs comes with several out-of-the-box authorization policies to enable the principle of least privilege for its users. The out-of-the-box authorization policy roles are:

Role Access Module Description
Policy Editor Complete read and write access Policies and policy templates Primarily used to allow users to manage policies.
Export Export SBOM and VEX
Complete read and write access Notifications
Read-only All modules
Code Scanner Scan Projects and repositories Primarily used for a CI/CD-based service account
Complete read and write access Policies and policy templates
Complete read and write access Projects and repositories
Complete read and write access Findings
Complete read and write access Notifications
Read-only All modules
Read-Only Read-only All modules Primarily used to grant read-only access to all modules in the application
Export Export SBOM and VEX
Admin Complete read and write access All modules Primarily used to grant complete access to the application

Supported authentication providers

Authentication through Endor Labs is done through an external identity provider. Some authentication mechanisms are generally designed for human users, while others are designed for machine identities.

Supported authentication mechanisms designed for human users include:

  • Google - Authentication is provided through a users Google workspaces or gmail account.
  • GitHub - Authentication is provided through a users GitHub account.
  • GitLab - Authentication is provided through a users GitLab account.
  • Email - Authentication is provided through an email link sent to a user.
  • Custom Identity Providers - An enterprise identity provider such as Okta or VMWare One, which uses SAML or OIDC protocol. Learn more at our documentation on setting up a custom identity provider

Authentication mechanisms designed for machine identities, such as continuous integration or automation systems include:

Set up authorization policies

To set up an authorization policy to your Endor Labs tenant:

  1. Go to Manage > Access Control on the left-hand navigation.
  2. Ensure you are on the Auth Policy top navigation tab.
  3. Click Add Auth Policy.
  4. Select the identity provider that you would like to set up an authorization policy for.
  5. Select the permissions that a matching identity is authorized for.
  6. Select an expiration time for which an authorization rule may exist in the system.
    • This may be either No expiration, 24 hours, 72 hours, one week, two weeks, or 30 days.
  7. Select the claims for which the authorization rule will provide access
    • For GitHub and GitLab this may be the users platform handle
    • For Google, this may be the users e-mail address or the e-mail addresses domain.
    • For a custom identity provider, this may be set to a key value pair associated with the claims provided by your external identity provider.
    • For Email this may be the email address an authentication link is sent to.
    • For GitHub Action OIDC this may be the organization or repository for which a workload runs under.
    • For AWS Role this may be the AWS ARN of the role the machine is set to impersonate.
    • For Google Cloud this may be the principal email of a service account the workload is set to impersonate.
  8. Under Advanced you may select a set of namespaces for which an authorization policy may apply. If you choose to propagate this policy to all child namespaces then the authorization policy will be applied to any selected namespaces and their children.
  9. click Add Auth Policy to save your authorization policy.

After adding the authorization policy, a user with the corresponding authorization claims can sign in to Endor Labs with their configured permissions.

See Invite users to Endor Labs.