Migrating users

Agent access definitions are reapplied during every helm upgrade through the ProductConfiguration custom resource.

User-to-role assignments stored in the PPC authentication layer are not migrated automatically. Before removing any legacy assignments, assign the replacement Agent roles to all existing user accounts and verify that each user can successfully sign in and access the Agent.

Remove the legacy role assignments only after validating that the new assignments function as expected for all users.

Note: To access the Agent panel, assign the agent-user role.

The agent-model-administrator role is introduced in Protegrity Agent v1.2.0 and has no equivalent in Agent v1.0. Assign this role explicitly to users who need permission to configure and manage models.

Protegrity Agent v1.2.0 does not require any workbench_* roles. Existing Workbench role assignments may be retained or removed based on the Policy Workbench responsibilities of the required user. It has no impact on Agent access or permissions.

Migrating users

To migrate users, perform the following steps:

1. Complete the helm chart v2.0.0 upgrade. This ensures that the new Agent role definitions exist.
   For more information about upgrading the helm chart to v2.0.0, refer to Upgrading the Agent to v1.2.0.

2. Verify that the replacement PPC roles are available with GET /pty/v1/auth/roles.
   To inspect role definitions, run the following command:

   curl -sk "https://$FQDN/pty/v1/auth/roles" \
    -H "Authorization: Bearer $TOKEN" | jq .
   

3. Add the required PPC assignment for the replacement role to every existing user account. Assign agent-model-administrator explicitly to the accounts that should manage models. Ensure that any Agent v1.0 roles are attached to it.

4. Verify that users assigned the agent-user role can use conversations but receive a 403 error when running /model-config.

5. Verify that users assigned the agent-model-administrator role can use /model-config but receive a 403 error when running /conversations.

6. Remove the old proagent_administrator and agent_admin assignments only after all affected accounts successfully verify these checks.

7. Run admin list users command and confirm that every migrated account has the expected replacement assignments and no obsolete assignments.