Groups: console walkthrough

The same operations as the step-by-step guide, done in the console.

This console page has a guided tour

Click Start the tour beside the create button for a walkthrough that highlights each field as you go.

List

In the IAM perspective, Groups lists the groups in the selected project's domain.

Create

Create Group opens a guided form.

• Group name - name it for the role people hold, not for the thing they may touch.
• Description - worth filling in when the name alone will not tell a colleague who belongs in it.
• Parent group - None - top level group by default.

Realm appears above the name only when the project has more than one domain. With a single domain it is chosen for you.

Nesting grants the parent's access to every member

A child group inherits everything its parent has. Putting a narrow group under a broad one gives its members everything the broad group holds, which is rarely what is intended.

If you are not sure, choose None. A top-level group can always be granted the same things explicitly, and it cannot leak access it was never given. The parent cannot be changed afterwards.

Change

The console form creates groups; it does not edit them. The description can be changed with oc - see Change. The name, realm and parent are fixed.

Membership is not managed here

A user's groups are held on the user, not on the group, so there is no member list on this page. To change who is in a group, edit the user - see Users.

Delete

Use the kebab menu at the end of the row.

Deleting a group removes it from every user who was in it. Those users keep their accounts and lose whatever the group gave them.

Delete child groups before their parent.

Where the console differs from the CLI

	Console	oc
Realm reference	Filled in when there is one domain	You write spec.realmRef.name - the object name, not the domain
Parent group	Picked from a list of existing groups	You write the object name
Membership	Managed on the user	Managed on the user
Editing	Not offered	Description only