Procedure

1. Register your Developer Hub app in RHBK:

   1. Use an existing realm, or create a realm, with a distinctive Name such as <my_realm>. Save the value for the next step:

2. RHBK realm base URL, such as: <your_rhbk_URL>/realms/<your_realm>.

   1. To register your Developer Hub in RHBK, in the created realm, secure the first application, with:

      1. Client ID: A distinctive client ID, such as <RHDH>.
      2. Valid redirect URIs: Set to the OIDC handler URL: https://<my_developer_hub_domain>/api/auth/oidc/handler/frame.
      3. Go to the Credentials tab and copy the Client secret.
      4. Save the values for the next step:
3. Client ID

4. Client Secret

   1. To prepare for the verification steps, in the same realm, get the credential information for an existing user or create a user. Save the user credential information for the verification steps.
5. Create a long, complex, and unique string to use as the Developer Hub session secret key.

6. Add your RHBK credentials and the session secret key to Developer Hub, by adding the following key-value pairs to your Developer Hub secrets. You can use these secrets in the Developer Hub configuration files by using their environment variable name.

   KEYCLOAK_CLIENT_ID

   Enter the saved Client ID.

   KEYCLOAK_CLIENT_SECRET

   Enter the saved Client Secret.

   KEYCLOAK_BASE_URL

   Enter the saved RHBK realm base URL.

   KEYCLOAK_REALM

   Enter the realm name to provision users.

   KEYCLOAK_LOGIN_REALM

   Enter the realm name to authenticate users.

   SESSION_SECRET

   Enter the created session secret key.

Procedure

1. Enable the Keycloak catalog provider plugin in your dynamic-plugins.yaml file.

   The plugin is named after RHBK upstream project.

   This plugin imports RHBK users and groups to the Developer Hub software catalog.

   plugins:
     - package: './dynamic-plugins/dist/backstage-community-plugin-catalog-backend-module-keycloak-dynamic'
       disabled: false

2. Enable provisioning RHBK users and groups to the Developer Hub software catalog, by adding the catalog.providers.keycloakOrg section to your app-config.yaml file:

   catalog:
     providers:
       keycloakOrg:
         default:
           baseUrl: ${KEYCLOAK_BASE_URL}
           clientId: ${KEYCLOAK_CLIENT_ID}
           clientSecret: ${KEYCLOAK_CLIENT_SECRET}
           realm: ${KEYCLOAK_REALM}
           loginRealm: ${KEYCLOAK_LOGIN_REALM}

   baseUrl

   Enter your RHBK server URL, defined earlier.

   clientId

   Enter your Developer Hub application client ID in RHBK, defined earlier.

   clientSecret

   Enter your Developer Hub application client secret in RHBK, defined earlier.

   realm

   Enter the realm name to provision users.

   loginRealm

   Enter the realm name to authenticate users.

3. Optional: Add optional fields to the keycloackOrg catalog provider section in your app-config.yaml file:

   catalog:
     providers:
       keycloakOrg:
         default:
           baseUrl: ${KEYCLOAK_BASE_URL}
           clientId: ${KEYCLOAK_CLIENT_ID}
           clientSecret: ${KEYCLOAK_CLIENT_SECRET}
           realm: ${KEYCLOAK_REALM}
           loginRealm: ${KEYCLOAK_LOGIN_REALM}
           userQuerySize: 100
           groupQuerySize: 100
           schedule:
             frequency: { hours: 1 }
             timeout: { minutes: 50 }
             initialDelay: { seconds: 15}

   userQuerySize

   Enter the user count to query simultaneously. Default value: 100.

   groupQuerySize

   Enter the group count to query simultaneously. Default value: 100.

   schedule

   frequency

   Enter the schedule frequency. Supports cron, ISO duration, and "human duration" as used in code.

   timeout

   Enter the timeout for the user provisioning job. Supports ISO duration and "human duration" as used in code.

   initialDelay

   Enter the initial delay to wait for before starting the user provisioning job. Supports ISO duration and "human duration" as used in code.

Procedure

1. The OIDC provider authentication backend plugin requires Developer Hub to support sessions. Enable session support by adding the session secret to your app-config.yaml file:

   auth:
     session:
       secret: ${SESSION_SECRET}

2. Enable the RHBK authentication provider, by adding the OIDC provider section in your app-config.yaml file:

   auth:
     environment: production
     providers:
       oidc:
         production:
           metadataUrl: ${KEYCLOAK_BASE_URL}
           clientId: ${KEYCLOAK_CLIENT_ID}
           clientSecret: ${KEYCLOAK_CLIENT_SECRET}
           prompt: auto
   signInPage: oidc

   environment: production

   Mark the environment as production to hide the Guest login in the Developer Hub home page.

   metadataUrl, clientId, clientSecret

   Configure the OIDC provider with your secrets.

   prompt

   Enter auto to allow the identity provider to automatically determine whether to prompt for credentials or bypass the login redirect if an active RHBK session exists.

   The identity provider defaults to none, which assumes that you are already logged in. Sign-in requests without an active session are rejected.

   signInPage

   Enter oidc to enable the OIDC provider as default sign-in provider.

3. Optional: Add optional fields to the OIDC authentication provider section in your app-config.yaml file:

   auth:
     providers:
       oidc:
         production:
           metadataUrl: ${KEYCLOAK_BASE_URL}
           clientId: ${KEYCLOAK_CLIENT_ID}
           clientSecret: ${KEYCLOAK_CLIENT_SECRET}
           callbackUrl: ${KEYCLOAK_CALLBACK_URL}
           tokenEndpointAuthMethod: ${KEYCLOAK_TOKEN_ENDPOINT_METHOD}
           tokenSignedResponseAlg: ${KEYCLOAK_SIGNED_RESPONSE_ALG}
           additionalScopes: ${KEYCLOAK_SCOPE}
           signIn:
             resolvers:
               - resolver: oidcSubClaimMatchingKeycloakUserId
               - resolver: preferredUsernameMatchingUserEntityName
               - resolver: emailMatchingUserEntityProfileEmail
               - resolver: emailLocalPartMatchingUserEntityName
                 dangerouslyAllowSignInWithoutUserInCatalog: true
           sessionDuration: { hours: 24 }
     backstageTokenExpiration: { minutes: _<user_defined_value>_ }
   signInPage: oidc

   callbackUrl

   RHBK callback URL.

   tokenEndpointAuthMethod

   Enter your token endpoint authentication method.

   tokenSignedResponseAlg

   Token signed response algorithm.

   additionalScopes

   Enter additional RHBK scopes to request for during the authentication flow.

   signIn

   resolvers

   After successful authentication, the user signing in must be resolved to an existing user in the Developer Hub catalog. To best match users securely for your use case, consider configuring a specific resolver.

   Enter the resolver list to override the default resolver: oidcSubClaimMatchingKeycloakUserId.

   Available values:

   oidcSubClaimMatchingKeycloakUserId

   Matches the user with the immutable sub parameter from OIDC to the RHBK user ID. Consider using this resolver for enhanced security.

   emailLocalPartMatchingUserEntityName

   Matches the email local part with the user entity name.

   emailMatchingUserEntityProfileEmail

   Matches the email with the user entity profile email.

   preferredUsernameMatchingUserEntityName

   Matches the preferred username with the user entity name.

   The authentication provider tries each sign-in resolver in order until it succeeds, and fails if none succeed.

   Warning

   In production mode, configure only one resolver to make sure users are securely matched.

   dangerouslyAllowSignInWithoutUserInCatalog: true

   Configure the sign-in resolver to bypass the user provisioning requirement in the Developer Hub software catalog.

   Warning

   In production mode, do not enable the dangerouslyAllowSignInWithoutUserInCatalog option.

   sessionDuration

   Lifespan of the user session. Enter a duration in ms library format (such as '24h', '2 days'), ISO duration, or "human duration" as used in code.

   backstageTokenExpiration

   Enter a value to modify the Developer Hub token expiration from its default value of one hour. It refers to the validity of short-term cryptographic tokens, not to the session duration. The expiration value must be set between 10 minutes and 24 hours.

   Warning

   If multiple valid refresh tokens are issued due to frequent refresh token requests, older tokens will remain valid until they expire. Enhance security and prevent potential misuse of older tokens by enabling a refresh token rotation strategy in your RHBK realm.

   1. From the Configure section of the navigation menu, click Realm Settings.
   2. From the Realm Settings page, click the Tokens tab.
   3. From the Refresh tokens section of the Tokens tab, toggle the Revoke Refresh Token to the Enabled position.

4. To disable the guest login option, in the app-config.yaml file, set the authentication environment to production:

   auth:
     environment: production

Verification

1. To verify RHBK user authentication:

   1. Go to the Developer Hub login page.
   2. Your Developer Hub sign-in page displays Sign in using OIDC and the Guest user sign-in is disabled.
   3. Log in with OIDC by using the saved Username and Password values.

Procedure

1. Allow Developer Hub to authenticate with GitHub, by creating a GitHub App.

   Note

   Use a GitHub App instead of an OAuth app to use fine-grained permissions, use short-lived tokens, scale with the number of installations by avoiding rate limits, and have a more transparent integration by avoiding to request user input.

   1. Register a GitHub App with the following configuration:

      GitHub App name

      Enter a unique name identifying your GitHub App, such as authenticating-with-rhdh-<GUID>.

      Homepage URL

      Enter your Developer Hub URL: https://<my_developer_hub_domain>.

      Authorization callback URL

      Enter your Developer Hub authentication backend URL: https://<my_developer_hub_domain>/api/auth/github/handler/frame.

      Webhook

      Clear "Active".

      Organization permissions

      Enable Read-only access to Members.

      Where can this GitHub App be installed?

      Select Only on this account.

   2. In the General → Clients secrets section, click Generate a new client secret.
   3. In the Install App tab, choose an account to install your GitHub App on.
   4. Save the following values for the next step:
2. Client ID
3. Client secret

4. Add your GitHub credentials to Developer Hub by adding the following key/value pairs to your Developer Hub secrets. You can use these secrets in the Developer Hub configuration files by using their environment variable name.

   GITHUB_CLIENT_ID

   Enter the saved Client ID.

   GITHUB_CLIENT_SECRET

   Enter the saved Client Secret.

   GITHUB_URL

   Enter the GitHub host domain: https://github.com.

   GITHUB_ORG

   Enter your GitHub organization name, such as <your_github_organization_name>.

Procedure

1. Enable the GitHub catalog provider plugin in your dynamic-plugins.yaml file to import GitHub users and groups to the Developer Hub software catalog.

   plugins:
     - package: './dynamic-plugins/dist/backstage-plugin-catalog-backend-module-github-org-dynamic'
       disabled: false

2. Enable provisioning GitHub users and groups to the Developer Hub software catalog by adding the GitHub catalog provider section to your app-config.yaml file:

   catalog:
     providers:
       githubOrg:
         id: githuborg
         githubUrl: "${GITHUB_URL}"
         orgs: [ "${GITHUB_ORG}" ]
         schedule:
           frequency:
             minutes: 30
           initialDelay:
             seconds: 15
           timeout:
             minutes: 15

   id

   Enter a stable identifier for this provider, such as githuborg.

   Warning

   Entities from this provider are associated with this identifier. Therefore, do not to change the identifier over time since that might lead to orphaned entities or conflicts.

   githubUrl

   Enter the configured secret variable name: ${GITHUB_URL}.

   orgs

   Enter the configured secret variable name: ${GITHUB_ORG}.

   schedule.frequency

   Enter your schedule frequency, in the cron, ISO duration, or "human duration" format.

   schedule.timeout

   Enter your schedule timeout, in the ISO duration or "human duration" format.

   schedule.initialDelay

   Enter your schedule initial delay, in the ISO duration or "human duration" format.

Procedure

1. Enable the GitHub authentication provider, by adding the GitHub authentication provider section to your app-config.yaml file:

   auth:
     environment: production
     providers:
       github:
         production:
           clientId: ${GITHUB_CLIENT_ID}
           clientSecret: ${GITHUB_CLIENT_SECRET}
   signInPage: github

   environment

   Enter production to disable the Guest login option in the Developer Hub login page.

   clientId

   Enter the configured secret variable name: ${GITHUB_CLIENT_ID}.

   clientSecret

   Enter the configured secret variable name: ${GITHUB_CLIENT_SECRET}.

   signInPage

   Enter github to enable the GitHub provider as your Developer Hub sign-in provider.

2. Optional: Add optional fields to the GitHub authentication provider section in your app-config.yaml file:

   auth:
     environment: production
     providers:
       github:
         production:
           clientId: ${GITHUB_CLIENT_ID}
           clientSecret: ${GITHUB_CLIENT_SECRET}
           callbackUrl: <your_intermediate_service_url/handler>
           sessionDuration: { hours: 24 }
           signIn:
             resolvers:
               - resolver: usernameMatchingUserEntityName
                 dangerouslyAllowSignInWithoutUserInCatalog: true
   signInPage: github

   callbackUrl

   Enter the callback URL that GitHub uses when initiating an OAuth flow, such as: <your_intermediate_service_url/handler>. Define it when Developer Hub is not the immediate receiver, such as in cases when you use one OAuth app for many Developer Hub instances.

   sessionDuration

   Enter the user session lifespan, in ms library format (such as '24h', '2 days'), ISO duration, or "human duration".

   signIn

   resolvers

   After successful authentication, Developer Hub resolves the user signing in to an existing user in the Developer Hub catalog. Configure a specific resolver to best match users securely for your use case..

   Enter the resolver list to override the default resolver: usernameMatchingUserEntityName.

   The authentication provider tries each sign-in resolver in order until it succeeds. If none of the attempts succeed, the sign-in fails.

   Warning

   In production mode, configure only one resolver to make sure users are securely matched.

   resolver

   Enter the sign-in resolver name. Available resolvers:

3. usernameMatchingUserEntityName
4. preferredUsernameMatchingUserEntityName

5. emailMatchingUserEntityProfileEmail

   dangerouslyAllowSignInWithoutUserInCatalog

   Enter true to configure the sign-in resolver to bypass the user provisioning requirement in the Developer Hub software catalog.

   Warning

   In production more, do not enable dangerouslyAllowSignInWithoutUserInCatalog.

6. To disable the guest login option, in the app-config.yaml file, set the authentication environment to production:

   auth:
     environment: production

Verification

1. To verify GitHub authentication:

   1. Go to the Developer Hub login page.
   2. Your Developer Hub sign-in page displays Sign in using GitHub and the Guest user sign-in is disabled.
   3. Log in with a GitHub account.

Procedure

1. Register your Developer Hub app in Azure, by using the Azure portal.

   1. Sign in to the Microsoft Entra admin center.
   2. Optional: If you have access to multiple tenants, use the Settings icon in the top menu to switch to the tenant in which you want to register the application from the Directories + subscriptions menu.

   3. Browse to Applications > App registrations, and create a New registration with the configuration:

      Name

      Enter a name to identify your application in Azure, such as <Authenticating with Developer Hub>.

      Supported account types

      Select Accounts in this organizational directory only.

      Redirect URI

      Select a platform

      Select Web.

      URL

      Enter the backend authentication URI set in Developer Hub: https://<my_developer_hub_domain>/api/auth/microsoft/handler/frame

   4. On the Applications > App registrations > <Authenticating with Developer Hub> > Manage > API permissions page, Add a Permission, Microsoft Graph, select the following permissions:

      Application Permissions

      GroupMember.Read.All, User.Read.All

      Enter permissions that enable provisioning user and groups to the Developer Hub software catalog.

      Optional: Grant admin consent for these permissions. Even if your company does not require admin consent, consider doing so as it means users do not need to individually consent the first time they access Developer Hub.

      Delegated Permissions

      User.Read, email, offline_access, openid, profile

      Enter permissions that enable authenticating users.

      Optional: Enter optional custom scopes for the Microsoft Graph API that you define both here and in your app-config.yaml Developer Hub configuration file.

   5. On the Applications > App registrations > <Authenticating with Developer Hub> > Manage > Certificates & secrets page, in the Client secrets tab, create a New client secret.

   6. Save the following values for the next step:

      • Directory (tenant) ID
      • Application (client) ID
      • Application (client) Secret ID

2. Add your Azure credentials to Developer Hub, by adding the following key/value pairs to your Developer Hub secrets:

   MICROSOFT_TENANT_ID

   Enter your saved Directory (tenant) ID.

   MICROSOFT_CLIENT_ID

   Enter your saved Application (client) ID.

   MICROSOFT_CLIENT_SECRET

   Enter your saved Application (client) secret.

Procedure

1. Enable the Microsoft Graph catalog provider plugin in your dynamic-plugins.yaml file. This plugin imports Azure users and groups to the Developer Hub software catalog.

   plugins:
     - package: './dynamic-plugins/dist/backstage-plugin-catalog-backend-module-msgraph-dynamic'
       disabled: false

2. Enable provisioning Azure users and groups to the Developer Hub software catalog, by adding the Microsoft Graph catalog provider section in your app-config.yaml file:

   catalog:
     providers:
       microsoftGraphOrg:
         providerId:
           target: https://graph.microsoft.com/v1.0
           tenantId: ${MICROSOFT_TENANT_ID}
           clientId: ${MICROSOFT_CLIENT_ID}
           clientSecret: ${MICROSOFT_CLIENT_SECRET}
           schedule:
             frequency:
               hours: 1
             timeout:
               minutes: 50
             initialDelay:
               minutes: 50

   target

   Enter https://graph.microsoft.com/v1.0 to define the MSGraph API endpoint the provider is connecting to. You might change this parameter to use a different version, such as the beta endpoint.

   tenandId

   Enter the configured secret variable name: ${MICROSOFT_TENANT_ID}.

   clientId

   Enter the configured secret variable name: ${MICROSOFT_CLIENT_ID}.

   clientSecret

   Enter the configured secret variable name: ${MICROSOFT_CLIENT_SECRET}.

   schedule

   frequency

   Enter the schedule frequency in the cron, ISO duration, or human duration format. In a large organization, user provisioning might take a long time, therefore avoid using a low value.

   timeout

   Enter the schedule timeout in the ISO duration or human duration format. In a large organization, user provisioning might take a long time, therefore avoid using a low value.

   initialDelay

   Enter the schedule initial delay in the ISO duration or human duration format.

3. Optional: Add optional fields to the Microsoft authentication provider section in your app-config.yaml file:

   catalog:
     providers:
       microsoftGraphOrg:
         providerId:
           authority: https://login.microsoftonline.com/
           queryMode: advanced
           user:
             expand: manager
             filter: accountEnabled eq true and userType eq 'member'
             loadPhotos: true
             select: ['id', 'displayName', 'description']
           userGroupMember:
             filter: "displayName eq 'Backstage Users'"
             search: '"description:One" AND ("displayName:Video" OR "displayName:Drive")'
           group:
             expand: member
             filter: securityEnabled eq false and mailEnabled eq true and groupTypes/any(c:c+eq+'Unified')
             search: '"description:One" AND ("displayName:Video" OR "displayName:Drive")'
             select: ['id', 'displayName', 'description']

   authority

   Enter your Azure authority URL if it is different from the default: https://login.microsoftonline.com.

   queryMode

   Enter advanced when the default basic query mode is insufficient for your queries to the Microsoft Graph API. See Microsoft Azure advanced queries.

   user

   Add this section to configure optional user query parameters.

   expand

   Enter your expansion parameter to include the expanded resource or collection referenced by a single relationship (navigation property) in your results. A single request can expand only one relationship. See Microsoft Graph query expand parameter.

   You can combine this parameter with userGroupMember.filter or user.filter.

   filter

   Enter your user filter. See Microsoft Graph API and Microsoft Graph API query filter parameters syntax.

   This parameter and userGroupMember.filter are mutually exclusive, specify only one.

   loadPhotos

   Developer Hub loads photos by default. Enter false to avoid loading user photos.

   select

   Enter the Microsoft Graph resource type list to retrieve.

   userGroupMember

   Add this section to use group membership to get users.

   filter

   Enter your filter to filter groups and fetch their members.

   This parameter and user.filter are mutually exclusive, specify only one.

   search

   Enter your search query to search for groups and fetch their members.

   This parameter and user.filter are mutually exclusive, specify only one.

   group

   Enter your configuration to get groups.

   expand

   Enter your expansion parameter to include the expanded resource or collection referenced by a single relationship (navigation property) in your results. A single request can expand only one relationship. See Customize Microsoft Graph responses with query parameters.

   You can combine this parameter with user.filter or userGroupMember.filter.

   filter

   Enter your group filter parameter. See Microsoft Graph API query group syntax.

   search

   Enter your group search parameter. See Microsoft Graph API query search parameter.

   select

   Enter the Microsoft Graph resource type list to retrieve.

Procedure

1. Enable Azure authentication, by adding the Microsoft authentication provider to your app-config.yaml file content:

   auth:
     environment: production
     providers:
       microsoft:
         production:
           clientId: ${MICROSOFT_CLIENT_ID}
           clientSecret: ${MICROSOFT_CLIENT_SECRET}
           tenantId: ${MICROSOFT_TENANT_ID}
   signInPage: microsoft

   environment

   Enter production to disable the Guest login option in the Developer Hub login page.

   clientId

   Enter the configured secret variable name: ${MICROSOFT_CLIENT_ID}.

   clientSecret

   Enter the configured secret variable name: ${MICROSOFT_CLIENT_SECRET}.

   tenantId

   Enter the configured secret variable name: ${MICROSOFT_TENANT_ID}.

   signInPage

   Enter microsoft to set the Azure provider as your Developer Hub sign-in provider.

2. Optional: Add optional fields to the Microsoft authentication provider section in your app-config.yaml file:

   auth:
     environment: production
     providers:
       microsoft:
         production:
           clientId: ${MICROSOFT_CLIENT_ID}
           clientSecret: ${MICROSOFT_CLIENT_SECRET}
           tenantId: ${MICROSOFT_TENANT_ID}
           domainHint: ${MICROSOFT_TENANT_ID}
           additionalScopes:
              - Mail.Send
           sessionDuration:
             hours: 24
           signIn:
             resolvers:
               - resolver: usernameMatchingUserEntityName
                 dangerouslyAllowSignInWithoutUserInCatalog: true
   signInPage: microsoft

   domainHint

3. Leave this parameter empty, or enter the tenant ID when your application registration is single-tenant.
4. Leave this parameter empty when your application registration is multitenant.

5. Enter the tenant ID to reduce login friction for users with accounts in multiple tenants, by automatically filtering out accounts from other tenants.

   For more information, see Home Realm Discovery.

   additionalScopes

   Enter the list of additional scopes to add scopes for the application registration. The default and mandatory value lists following scopes:

6. openid
7. offline_access
8. profile
9. email

10. User.Read

    sessionDuration

    Lifespan of the user session. Enter a duration in ms library (such as '24h', '2 days'), ISO duration, or "human duration" format.

    signIn.resolvers

    After successful authentication, Developer Hub resolves the user signing in to an existing user in the Developer Hub catalog. To best match users securely for your use case, consider configuring a specific resolver.

    Enter the resolver list to override the default resolver: userIdMatchingUserEntityAnnotation.

    The authentication provider tries each sign-in resolver in order until it succeeds, and fails if none succeed.

    Warning

    In production mode, configure only one resolver to make sure users are securely matched.

    resolver

    Enter the sign-in resolver name. Available resolvers:

    emailMatchingUserEntityAnnotation

    Use this resolver to look up the user by matching their Microsoft email to the email entity annotation.

    emailLocalPartMatchingUserEntityName

    Use this resolver to look up the user by matching their Microsoft email user name to the user entity name.

    emailMatchingUserEntityProfileEmail

    Use this resolver to look up the user by matching their Microsoft email to the user entity profile email.

    dangerouslyAllowSignInWithoutUserInCatalog

    Enter true to configure the sign-in resolver to bypass the user provisioning requirement in the Developer Hub software catalog.

    Warning

    In production mode, do not enable dangerouslyAllowSignInWithoutUserInCatalog.

11. To disable the guest login option, in the app-config.yaml file, set the authentication environment to production:

    auth:
      environment: production

Verification

1. To verify Azure user authentication:

   1. Go to the Developer Hub login page.
   2. Your Developer Hub sign-in page displays Sign in using Microsoft and the Guest user sign-in is disabled.
   3. Log in with an Azure account.

Procedure

1. Go to Administration at the bottom of the sidebar in the Developer Hub.

   The RBAC tab is displayed, showing all the created roles in the Developer Hub.

2. (Optional) Click any role to view the role information on the OVERVIEW page.
3. Click CREATE to create a role.
4. Enter the name and description of the role in the given fields and click NEXT.
5. Add users and groups using the search field, and click NEXT.
6. Select Plugin and Permission from the drop-downs in the Add permission policies section.
7. Select or clear the Policy that you want to set in the Add permission policies section, and click NEXT.
8. Review the added information in the Review and create section.
9. Click CREATE.

Procedure

1. Go to Administration at the bottom of the sidebar in the Developer Hub.

   The RBAC tab is displayed, showing all the created roles in the Developer Hub.

2. (Optional) Click any role to view the role information on the OVERVIEW page.
3. Select the edit icon for the role that you want to edit.
4. Edit the details of the role, such as name, description, users and groups, and permission policies, and click NEXT.
5. Review the edited details of the role and click SAVE.

Verification

1. After saving the changes, you can view the edited details of the role on the OVERVIEW page of the role.
2. You can also edit a role’s users and groups or permissions by using the edit icon on the Users and Groups or Permissions cards on the OVERVIEW page.

Procedure

1. Go to Administration at the bottom of the sidebar in the Developer Hub.

   The RBAC tab is displayed, showing all the created roles in the Developer Hub.

2. (Optional) Click any role to view the role information on the OVERVIEW page.

3. Select the delete icon from the Actions column for the role that you want to delete.

   The Delete this role? pop-up is displayed on the screen.

4. Click DELETE.