Arkime Roles

In Arkime 4.0 the concept of Roles was introduced to Arkime. We will be moving our permission model over to use roles. Starting with Arkime 4.3 we have strengthened the roles and clearly outlined the rules. Starting with Arkime 6, system roles and many user permissions now support inheritance. For each permission, you can either force a specific value or inherit it from the user’s assigned roles.

There are two classes of roles: System defined roles and User defined roles.

The system defined roles include:

  • superAdmin - Has all system roles assigned. Only superAdmin can create or edit other superAdmin users. Only superAdmin can assign the usersAdmin, arkimeAdmin, cont3xtAdmin, parliamentAdmin, wiseAdmin, and dbAdmin role to another user.
  • usersAdmin - Can create, update, and delete users (except for superAdmin users). Can assign and unassign non Admin roles to users. Can unassign Admin roles from users.
  • arkimeUser - Can use Arkime application, also known as viewer
  • arkimeAdmin - An arkimeAdmin is automatically assigned arkimeUser. An arkimeAdmin has extra ability to change Arkime configurations, view data for all Arkime Users (including superAdmins), and has different query limitations.
  • cont3xtUser - Can use Cont3xt application
  • cont3xtAdmin - A cont3xtAdmin is automatically assigned cont3xtUser. A cont3xtAdmin has extra ability to change Cont3xt configurations and view data for all Cont3xt Users (including superAdmins).
  • parliamentUser - Can use the issues feature of parliament
  • parliamentAdmin - A parliamentAdmin is automatically a parliamentUser. A parliamentAdmin can configure the clusters and settings in parliament.
  • wiseUser - View raw data for a WISE source and get all configurations.
  • wiseAdmin - A wiseAdmin is automatically a wiseUser. A wiseAdmin can setup new wise sources and edit the source data.
  • dbAdmin - (Added in 6.7.0) Can perform Elasticsearch/OpenSearch database administration tasks, such as managing cluster settings, shards, and indices from the ES Admin UI. This role replaces the deprecated esAdminUsers setting, which will be removed in Arkime 7.
  • mcpUser - (Added in 6.7.0) Can use the MCP endpoint of any application that has it enabled. This is required in addition to the application’s own role, so a user needs both arkimeUser and mcpUser to use Arkime’s MCP endpoint. Only superAdmin is automatically assigned mcpUser, arkimeAdmin and cont3xtAdmin deliberately are not, so turning MCP on never silently exposes data to an AI assistant. To grant it to existing users in bulk use db.pl <host:port> users-update '*' --addRole mcpUser.

User defined roles can be created and can reference system roles and some permissions. Any system role referenced by a user role will automatically be inherited by the user. For example if user role SecGroup is created and includes both arkimeUser and cont3xtUser, any user assigned the SecGroup role will also have access to Arkime & Cont3xt even if the user doesn’t have the arkimeUser/cont3xtUser directly assigned.

High level Role Rules:

  • Only a user with the superAdmin role can create/modify/delete other users with the superAdmin role.
  • Only a user with the superAdmin role can assign another user the usersAdmin, arkimeAdmin, cont3xtAdmin, parliamentAdmin, wiseAdmin, dbAdmin roles. However a usersAdmin can still modify everything else about non superAdmins.
  • A user with the usersAdmin role but without the superAdmin role can add/modify/delete any user but a user with the superAdmin role. They can unassign Admin roles from non superAdmin users, but they can not assign Admin roles.
  • The application Admin users can view application data for all users, including other Admin and superAdmins users
  • webEnabled and headerAuthEnabled values are not inherited from roles. They must be set on each user individually.

Creating User defined Roles Programmatically:

Behind the scenes, user defined roles are stored in the users database with a leading role: prefix. You can use the arkime_add_user script to create a user defined role. /opt/arkime/bin/arkime_add_user.sh role:role-name "Role Name" passwordignored [other-options]

Arkime Logo