Roles

Define permission groups based on job functions and responsibilities.

In Connectware, a role is a named group of permissions that you assign to multiple users at once. Instead of configuring permissions for each user individually, you define a role once and reuse it, which keeps access control consistent as your team changes.

For an explanation of how permissions work and their syntax, see Permissions.

Roles View

The Roles View provides a comprehensive dashboard of all defined roles in your Connectware system and their associated permissions. This makes it easy to audit your access control structure and identify which permissions are assigned to each role.

• To open the Roles View, click User and then click the Roles tab.

Roles View in Connectware

In this view, you can quickly identify:

• All available roles in the system.

• The specific permissions assigned to each role.

• Which roles might need modifications based on your security requirements.

Creating New Roles and Permissions

Creating roles allows you to define permission sets once and apply them to multiple users.

1. In the Roles View, click Add Role to open the Create Role dialog.

Add Role button

1. Enter a name for the new role.

2. Optional: To assign a set of pre-defined permissions to the role, click the Copy Permissions field, select a permission, and click Add. You can repeat this step to assign multiple permission sets.

3. Optional: To assign individual permissions, click the + button to open the Add Permission dialog.

• Select the permission type: HTTP for accessing the REST API using HTTP clients or MQTT for accessing MQTT topics on CybusMQ.

• In the Endpoint field, enter the resource path. Wildcards (+ and #) are supported. For syntax details, see Permissions.

• Select the access type: read, write, or both.

• Click Add to add the permission.

1. Click Create. The dialog closes, and the new role appears in the overview table.

Changing Role Names

To change the name of an existing role:

1. In the Roles View, click a role to open the Edit Role dialog.

2. In the Edit Role dialog, enter a new role name in the Name field.

Edit Role dialog

1. Click Update to apply the changes. The dialog closes, and the role name is updated.

Adding Permissions to Roles

You can add individual permissions directly to a role as needed.

1. In the navigation panel, click User.

2. Click the Roles tab.

3. In the Roles View, click the role to which you want to assign permissions. This opens the Edit Role dialog.

4. In the Edit Role dialog, click the + button to open the Add Permission dialog.

   • Select the permission type: HTTP for accessing the REST API using HTTP clients or MQTT for accessing MQTT topics on CybusMQ.

   • In the Endpoint field, enter the resource path. Wildcards (+ and #) are supported. For syntax details, see Permissions.

   • Select the access type: read, write, or both.

   • Click Add to add the permission.

5. Click Update. The dialog closes, and the role is updated with the new permissions.

The updated role reflects the change immediately, and all users assigned to this role gain the new permissions.

Removing Permissions from Roles

When specific permissions are no longer needed, you can remove them while keeping other permissions intact.

1. In the navigation panel, click User.

2. Click the Roles tab.

3. In the Roles View, click the role you want to modify to open the Edit Role dialog.

4. Permissions are organized into tabs for HTTP and MQTT. Use the tabs to switch between and manage permissions for each protocol.

5. In the list of assigned permissions, locate the permission you want to remove.

6. Click its Remove button in the Action column of the permissions list.

7. Click Update. The dialog closes, and the role is updated.

The updated role reflects the change immediately, and all users assigned to this role lose the removed permission.

Deleting Roles

To delete a role:

1. In the Roles View, click the role that you want to delete to open the Edit Role dialog.

2. Click the Delete button in the top right of the Edit Role dialog.

Delete Role button

1. Click Delete again to confirm. The dialog closes, and the role is deleted.

Delete confirmation

Built-In Roles

Connectware includes the following predefined roles. They cannot be deleted.

connectware-admin

Full administrative access to Connectware. This role grants:

• Complete access to all Admin UI pages and actions.

• Read/write access to all MQTT topics and HTTP endpoints.

• The ability to create, modify, and delete users, roles, and permissions.

• Access to all service management operations.

Assign this role only to users who need to administer the full Connectware system. The default admin user is created with this role during installation.

minimum-access

Read-only access to the Admin UI with no data permissions. Users with this role can:

• Log in to the Admin UI and view most pages.

• Not publish or subscribe to any MQTT topics.

• Not call any REST API endpoints beyond those needed to view the Admin UI.

This role is useful as a baseline for users who need visibility into the system without the ability to change anything. It is also the starting point for custom roles with limited scope: create a new role, copy the minimum-access permissions, and add only the additional permissions your use case requires.