# Assign roles to users within a project

> Learn how to assign roles to users within a project to grant access to the requierd resources.

## Overview of roles assignment to users in CubeCMP {#overview-of-roles-assignment-to-users-in-cubecmp}

User roles define which resources a user account can access within a CubeCMP project. By assigning appropriate roles, you control access to cloud resources and enforce resource allocation and compliance policies. CubeCMP uses a role-based access control (RBAC) model that scales efficiently across multiple projects.

Role assignments are configured in User Management by setting a role label on the user account. CubeCMP determines project access based on the value of this label.

## Prerequisites {#prerequisites}

- Note down the case-sensitive project name that you want to manage the user permissions for
- Existing usernames to assign roles to

## Role label format {#role-label-format}

The role assignment is defined in the user manage with a role label. To assign project roles to users, use the following syntax for the role label.

- `<project-name>` should match the exact name of the target project.
- Use a single hyphen (-) to separate the project name and the assigned role.
- `<role>` must be one of the following:
  - `admin`: Grants full access and control over all project resources.
  - `member`: Grants access to assigned resources.

:::info

The `##` separator is only necessary when assigning roles to the same user across multiple projects.

:::

To assign a role to a user, refer to the following syntaxes.

```bash
<project-name>-<role>
```

```bash
<first-project-name>-<role>##<second-project-name>-<role>
```

## Assign roles to grant access to resources {#assign-roles-to-grant-access-to-resources}

:::warning

Role labels follow these rules:

- Use the `##` prefix for the second and each subsequent project-role entry.
- The **Key** and **Value** fields are case-sensitive. Use the exact casing for project roles, project names, and role values.

:::

1. Navigate to `https://<your-portal-ip>/auth` and login with a user with administrative privileges.
2. Show all existing users.

   Navigate to `Manage -> Users`, click `View all users` to show all local authentication users.
   
   
   

3. Select the user ID of the user to manage roles.
4. Go to the `Attributes` tab in the user profile.
5. Enter `ProjectRole` in the `Key` field.
6. Enter the project and role to be assigned in the `Value` filed.

   
   
   

```bash
<project-name>-<role>
```

```bash
<first-project-name>-<role>##<second-project_name>-<role>
```

7. Click `Add` after entering the `Key` and `Value` fields.
8. Click `Save` to save the changes.

---

### Example configuration {#example-configuration}

You can assign a user different roles in multiple projects by combining multiple project-role labels in the same value. Each label explicitly associates the user with a project and role.

```bash
PROJ001-admin
```

Assigns the user as an admin of the `PROJ001` project.

```bash
PROJ001-admin##PROJ002-member
```

Assigning the `PROJ001-admin` role grants the user administrative access to project `PROJ001`. Appending `##PROJ002-member` further expands their permissions to include membership in project `PROJ002`.

You can modify or update these assignments at any time based on project requirements and access control policies.