Authorization¶
Once the Solution Manager authenticates a user, it authorizes this user. That is, it determines what tasks this user is allowed to perform on the Solution Manager.
There are two types of privileges:
The following sections explain what kind of users the Solution Manager considers and what privileges they have.
Global Privileges¶
Global privileges are privileges that you grant to a user or a role over all the environments or over all the environments of a certain type. If you need a more fine-grained control of what users are allowed to do, see the section Privileges Granted to a Role For an Environment below.
List of global privileges
Global Administrator (global_admin)¶
Global administrators are users that have the role global_admin. These users can do any operation on the Solution Manager.
Solution Manager Administrator (solution_manager_admin)¶
The administrators of the Solution Manager are users that have the role solution_manager_admin. Grant this role to the users that are going to be in charge of administering the Solution Manager and manage the Denodo licenses of the organization.
Users with this role can do these tasks:
Create, edit and remove environments, clusters and servers.
but cannot:
Manage deployment configurations.
Promotion Administrator (solution_manager_promotion_admin)¶
Promotion administrators are users that have the role solution_manager_promotion_admin. Grant this role to the users that are going to be in charge of creating revisions and promoting them from the development environment to testing, from testing to production, etc.
Users with this role can do these tasks:
but cannot:
Promotion Administrator for Specific Environments (solution_manager_promotion_admin_*)¶
Promotion administrators for certain environments are users that have one or more of these roles:
solution_manager_promotion_admin_development
solution_manager_promotion_admin_staging
solution_manager_promotion_admin_production
The users with these roles can do the same tasks as the promotion administrators but only on specific target environments. For example, the users with the role solution_manager_promotion_admin_production can only validate and deploy revisions on the environments whose license scenario is production.
The table Solution manager promotion roles below shows an overview of the different Solution Manager promotion administrator roles with their privileges to promote revisions created by users to different environment types.
Promotion (solution_manager_promotion)¶
Promotion users are users that have the role solution_manager_promotion. Grant this role to the users that are going to be responsible of creating revisions, validating this revisions and deploying them.
Users with this role can do these tasks:
but cannot:
Promotion for Specific Environments (solution_manager_promotion_*)¶
Promotion users for certain environments are users that have one or more of these roles:
solution_manager_promotion_development
solution_manager_promotion_production
solution_manager_promotion_staging
Grant this role to the users that are going to be responsible of creating revisions, validating this revisions and deploying them.
This user is interpreted from the Solution Manager point of view as a promotion user
with the difference that she can only validate and deploy her own revisions in the target
environments that have the specific scenario assigned. For example, a user with role
solution_manager_promotion_staging can only validate and deploy any of her revisions
in any staging environment.
Overview of the Promotion Roles
The following table shows an overview of the different Solution Manager promotion roles with their privileges to promote revisions created by users to different environment types:
Role |
User |
Environment Type |
|||
|---|---|---|---|---|---|
other user |
own user |
deployment |
staging |
production |
|
solution_manager_promotion_development |
|
|
|||
solution_manager_promotion_staging |
|
|
|||
solution_manager_promotion_production |
|
|
|||
solution_manager_promotion |
|
|
|
|
|
solution_manager_promotion_admin_development |
|
|
|
||
solution_manager_promotion_admin_staging |
|
|
|
||
solution_manager_promotion_admin_production |
|
|
|
||
solution_manager_promotion_admin |
|
|
|
|
|
For example, a user with role solution_manager_promotion_deployment can only promote revisions created by herself in any deployment environment. A user with role solution_manager_promotion_admin_production can only promote revisions created by the own user and other users in any production environment.
Monitor Administrators¶
Monitor administrators are users that have the role monitor_admin. Grant this role to the users that are going to be in charge of monitoring the Denodo servers and diagnose issues in them.
Users with this role can do these tasks:
but cannot:
Privileges Granted to a Role For an Environment¶
This section explains how to grant privileges to users over specific a environment. These privileges are more fine grained that the ones explained in the section above. You cannot grant these privileges directly to users, only to roles.
Only users with the role globaladmin can use this feature.
To grant a privilege to a role over a specific environment, follow these steps:
Click the menu Configuration > Permissions. This page lists all the environments.
Click the button
in the row of the environment. This will open a new tab: Permissions by environment.In this tab, click New, select the role and click Add role.
Select one or more privileges.
Click
.
Permissions by environment tab¶
The following list explains what each privilege allows the user to do over an environment:
CONNECT¶
Grant the Connect privilege to the users over the development environments in which they participate. That way, they will be able to use the Solution Manager as a single point of entry to the applications of Denodo.
Users with this privilege over an environment have access to the following:
Users with this privilege cannot do these tasks:
METADATA¶
Users with the METADATA privilege over an environment have access to all the configuration of this environment, its clusters and servers, in read-only mode, including:
Users with this privilege cannot do these tasks:
WRITE¶
Users with the Write privilege over an environment can create, configure and delete clusters on that environment. More specifically:
Users with this privilege cannot do these tasks:
EXECUTION¶
Users with the Execution privilege over an environment can do the following:
Information about the license assigned to this environment.
If this is a AWS-managed environment, its status.
Users with this privilege cannot do these tasks:
MONITOR¶
Users with the Monitor privilege over an environment can do the following:
Users with this privilege cannot do these tasks:
DEPLOY¶
Users with the Deploy privilege over an environment can do the following:
Users with this privilege cannot do these tasks:
DEPLOY ADMIN¶
Users with the Deploy Admin privilege over an environment can do the following:
Users with this privilege cannot do these tasks: