Users

This page describes how to add users to your HashiCorp Cloud Platform (HCP) account and manage their access to resources.

Introduction

When you sign up for a HashiCorp Cloud Platform (HCP) account for the first time, the HCP Portal takes you to the create organization page to set up your organization. You can invite additional users to the organization so that they can access the resources.

User provisioning methods

HCP supports the following methods for adding and managing users in your organization:

• Manual provisioning: Invite users by email and manage them directly in HCP. This is the default method. Refer to Invite users for more information.
• SSO just-in-time (JIT) provisioning: HCP automatically creates users the first they successfully authenticate with your identity provider using SSO. Refer to Single sign-on (SSO) overview for more information.
• SCIM provisioning: Automatically sync users from your identity provider when SCIM is enabled. HCP creates, updates, and removes users based on changes in your identity provider. Enabling SCIM disables SSO JIT provisioning. Refer to SCIM provisioning for more information.

For more information about SCIM provisioning, refer to SCIM provisioning.

Invite users

Use the following procedure to invite users into your organization using email. Organization admin role is required to invite and manage users.

1. Log into HCP Portal and choose your organization.
2. Click Access Control (IAM) in the sidebar and click +Invite user.
3. Enter their email address and click Add. You can repeat this step to continue adding users.
4. Choose a role from the Assign role drop-down menu and click Invite. Refer to the User Permissions for information about the roles you can assign.

Resend a pending invite

To resend an invite to a specific user:

1. Click Access Control (IAM) in the sidebar.
2. Click Pending invites.
3. Click on the dropdown of the user you want to resend an invite to and click Resend invite.

Manage users

You can remove user access or change roles from the Users screen. You must have admin permissions to invite and manage users.

1. Log into HCP Portal and choose your organization.
2. Click Access Control (IAM) in the sidebar.
3. Click on a user name.
4. You can perform the following actions:
   • Click Remove to delete the user from your organization.
   • Choose a new role from the Role drop-down menu.
5. Click Save.

Manage SCIM-provisioned users

When SCIM provisioning is enabled, user lifecycle management is handled by your identity provider:

• User creation: Users are automatically created in HCP when assigned to the application in your identity provider
• User updates: Profile changes made in your identity provider automatically sync to HCP
• User removal: Users removed from the application in your identity provider are automatically removed from HCP
• Role assignment: You can still assign roles to SCIM-provisioned users in HCP

To identify SCIM-provisioned users, check the SCIM provisioning column in the users list. Users with a status of Synced are managed by SCIM.

For more information, refer to SCIM provisioning.

User permissions

HCP uses a role-based access control (RBAC) system to enable members of your organizations and projects to perform actions in HCP and interact with resources. Some HCP applications allow you to assign roles for specific resources, such as an HCP Packer bucket. Refer to the individual HCP service's documentation for more information.

Types of Roles

You can configure HCP roles for an organization at two levels:

• Basic roles control permissions from all services in an organization. Basic roles are useful when you initially set up and adopt HCP, but you should replace them with fine-grained roles when adding production workloads.
• Fine-grained roles control permissions for one or more services. We recommend using fine-grained roles for access management when using HCP to manage production workloads and interact with production networks.

Inheritance

Each resource in an HCP organization has an IAM policy associated with it that sets the level of access allowed on that resource. This IAM policy is a data structure that provides a mapping of roles to principals assigned to that resource.

Users inherit role permissions according to the following hierarchy:

1. Role assigned in the organization.
2. Role assigned in the project.
3. Role assigned for the resource.

Permissions are inherited through the resource hierarchy. And they are effective for the resource they are assigned to and all of that resource's descendants.

For example, a user assigned the viewer role in an organization also has viewer role permissions for projects within the organization. Similarly, a user assigned the contributor role in a project also has contributor role permissions for resources within the project.

If a user has a viewer role in an organization and an admin role on a project in the same organization, the user receives a concatenation of viewer and admin role permissions within that specific project.

Access management

For more information about permissions, the different types of roles and how they can be used within HCP, checkout the Access Management page.