Create and manage teams

You can extend the user’s default permissions by granting them fine-grain permissions over resources. You do this by adding the user to a team. A team defines the permissions users have for resources that have the label com.docker.ucp.access.label applied to them. Keep in mind that a label can be applied to multiple teams with different permission levels.

To create a new team, go to the UCP web UI, and navigate to the Users & Teams page.

Click the Create button to create a new team, and assign it a name.

Add users to a team

You can now add and remove users from the team. Navigate to the Members tab, and click the Add User to Team button. Then choose the list of users that you want to add to the team.

Sync team members with your organization’s LDAP directory.

If UCP is configured to sync users with your organization’s LDAP directory server, you will have the option to enable syncing the new team’s members when creating a new team or when modifying settings of an existing team. Learn how to configure integration with an LDAP directory. Enabling this option will expand the form with additional field for configuring the sync of team members.

There are two methods for matching group members from an LDAP directory:

Match LDAP Group Members

This option specifies that team members should be synced directly with members of a group in your organization’s LDAP directory. The team’s membership will by synced to match the membership of the group.

Match LDAP Search Results

This option specifies that team members should be synced using a search query against your organization’s LDAP directory. The team’s membership will be synced to match the users in the search results.

Immediately Sync Team Members

Select this option to immediately run an LDAP sync operation after saving the configuration for the team. It may take a moment before the members of the team are fully synced.

Manage team permissions

To manage the permissions of the team, click the Permissions tab. Here you can specify a list of labels and the permission level users will have for resources with those labels.

In the example above, members of the ‘Operations’ team have permissions to create and edit resources that have the labels com.docker.ucp.access.label=operations applied, but can only view resources that have the com.docker.ucp.access.label=blog label.

There are four permission levels available:

Where to go next

• UCP permission levels