Authorization policies

Documentation Index

Fetch the complete documentation index at: https://docs.endorlabs.com/llms.txt

Use this file to discover all available pages before exploring further.

Authorization policies define the permissions provided to an identity authenticated by a supported identity provider when that identity meets specific rule criteria defined as attributes or claims about the identity. Authorization policies must contain the following information:

• The supported identity provider through which a given identity comes from.
• The role provided to an identity.
• An optional expiration time for the policy.
• The rule criteria or claims required for an identity to access Endor Labs.

After setting up the authorization policy, you can invite users to Endor Labs.

​

Set up authorization policies

To set up an authorization policy to your Endor Labs tenant:

1. Select User menu > Settings from the left sidebar.
2. Select Access Control > Auth Policy.
3. Select Add Auth Policy.
4. Select the identity provider for which you want to configure an authorization policy.
5. Select the role to be granted to a matching identity.
6. Select an expiration time for the authorization rule. This may be either No expiration, 24 hours, 72 hours, one week, two weeks, 30 days, 60 days, or 90 days.
7. Select the claims for which the authorization rule will provide access.
8. Select Add Permission Rule to define granular permissions by specifying resource kinds and allowed methods.
9. Under Advanced, select a set of namespaces for which the authorization policy applies. If you choose to propagate this policy to all child namespaces, then the authorization policy will apply to any selected namespaces and their children.
10. Click Add Auth Policy to save your authorization policy.

After adding the authorization policy, a user with the corresponding authorization claims can sign in to Endor Labs with their configured permissions. See Invite users to Endor Labs.

​

Claims

Claims are key-value pairs from your identity provider’s JWT or SAML token that Endor Labs evaluates when a user authenticates. Each claim has a:

• Key: the token attribute name
• Value: the expected attribute value

When an incoming token’s attributes match all the claims in a policy, Endor Labs grants the policy’s assigned role to that user. The following are the claim keys available for each identity provider and what values to enter.

​

Permission rules

Permission rules control what actions an authenticated identity can perform in Endor Labs. Each rule has two parts:

• Resource kind: The type of object the rule applies to, such as Project, Finding, AuthorizationPolicy, or ScanProfile. Use * to apply the rule to all resource kinds.
• Methods: The operations allowed on that resource. The following methods are available:
  • Read: Use this to grant view-only access to a resource without allowing any modifications.
  • Create: Use this to allow an identity to add new resources, such as creating projects or scan profiles.
  • Update: Use this when an identity needs to edit resources it did not necessarily create, such as updating findings or policies.
  • Delete: Assign this only when the identity explicitly needs to delete resources, as it cannot be undone.
  • All: Use this when an identity needs full control over a resource type.

You can add multiple rules to a single policy to compose exactly the access level you need. For example, you could allow Read on all resources using *, then add a separate rule granting Create and Update on Project only, giving a CI service account the ability to run scans without broader write access.

​

Search authorization policies

You can use the search functionality to find authorization policies based on specific criteria. To search for authorization policies:

1. Select User menu > Settings > Access Control.
2. Select Auth Policy.
3. Use the search bar to find policies by:
   • Rule: Search policies by any text or string patterns within the rule definitions.
   • Created By: Search policies by the email address of the creator.
   • Namespaces: Search policies associated with a specific namespace.

​

Edit authorization policies

To edit an authorization policy:

1. Select User menu > Settings > Access Control.
2. Select Auth Policy.
3. Click the vertical three dots on the right side of the policy you want to edit and click Edit Auth Policy.
4. You can update the identity provider, permission, expiration time, claims of key and value, and namespaces the policy applies to.
5. Click Propagate this policy to all child namespaces to apply this policy to all child namespaces within the hierarchy.
6. Click Update Auth Policy.

​

Delete authorization policies

To delete an authorization policy:

1. Select User menu > Settings from the left sidebar.
2. Select Access Control > Auth Policy.
3. Click the vertical three dots on the right side of the policy you want to delete and click Delete Auth Policy.
4. Click Confirm in Delete Authorization Policy.

​

Grant support access

You can give the Endor Labs team read-only access to your namespaces for a limited time, allowing them to offer technical support and resolve issues. You can revoke access and delete these policies at any time. See delete authorization policy for more information. To grant support access to your namespace:

1. Select User menu > Settings from the left sidebar.
2. Select Access Control > Auth Policy.
3. Select Grant Support Access.
4. Select an expiration time for the access from the drop down menu.
5. Click Grant Access.