Users and Roles¶
The Delphix Masking Service has a flexible and robust users and roles system that allows you to give users fine-grain privileges over what environments they have access to and what tasks they can and can not perform.
What are Roles?¶
A defined role is what is used to give a certain user privileges over certain environments and tasks. Roles can be defined by selecting a subset of actions that can be taken on certain objects.
Actions¶
When defining a role, you can select one or more of the following actions for the role to be able to perform:
-
View: Be able to view the object and important information about the object.
-
Add: Be able to add an instance of an object.
-
Update: Be able to update/edit an instance of an object.
-
Delete: Be able to delete an instance of an object.
-
Copy: Be able to create a copy of an object.
-
Export: Be able to export an object from a Delphix Engine.
-
Import: Be able to import an exported object into a Delphix Engine
Please note that not all of these actions are available for all objects in the masking service.
Objects¶
When defining a role, permission to perform the above actions can be defined on a per-object basis. These objects include:
General | Jobs | Settings |
---|---|---|
Environment | Profile Job | Domains |
Connection | Masking Job | Algorithms |
Ruleset | Profiler | |
Inventory | Profiler Set | |
Custom Algorithms | ||
File Format | ||
Users | ||
Diagnostic |
Refer to Delphix Masking Terminology for definitions of these objects.
Adding A Role¶
To add a role follow these steps:
1. Login into the Masking Engine and select the Settings tab.
2. Click the Add Roles button.
3. Enter a Role Name. The far-left column lists the items for which you can set privileges.
4. Select the checkboxes for the corresponding privileges that you want to apply. If there is no checkbox, that privilege is not available. For example, if you want this role to have View, Add, Update, and Run privileges for masking jobs, select the corresponding checkboxes in the Masking Job row.
5. When you are finished assigning privileges for this Role, click Submit.
Recommended Roles¶
While every organization will differ in what users and roles they define, Delphix uses these common/popular roles. Please note that each defined user can only have one role assigned to them.
Administrator — This role is assigned by enabling a user's Administrator setting in either the UI or API. A user with this role has unrestricted access to all the engine functions. Specifically, the user has all privileges available through the roles system and the following additional, Administrator-only privileges:
- Sync
- A User's
apiAccess
anduserStatus
setting - Audit Page
- Admin > Users Generate Key Button
- Admin > Email Notification
- Admin > Utilization
- Deletion of any object: An Admin can delete any object, such as any Algorithm, Domain, Profile Expression, or Profile Set. In contrast, a user with the All Privileges role can can only delete objects they created.
- Settings > Roles
IT Security Analyst — Unrestricted access for all settings functions; access to all application functions except environment and environment create, delete, update.
IT Security Analyst role JSON
All Privileges — Unrestricted access for an application environment; central admin or security analyst will determine if this role can modify settings.
All Privileges role JSON
DBA — Manage connections for application database, scripting and scheduling (no settings).
DBA role JSON
SME/Analyst/Developer — Manage inventories, create, view jobs.
SME/Analyst/Developer role JSON
Operator — All job privileges.
Operator role JSON
Environment Owner — Approve workflow and inventories, privileges to view for settings and environment.
Environment Owner role JSON
What are Users?¶
Once you have your roles defined, it is time to create users with those roles. We highly recommend creating independent users for each individual who will have access to the masking service.
Adding a User¶
To create a new user using the Masking UI follow these steps:
-
Login into the Masking Engine and select the Admin tab.
-
Click Add User at the upper right of the Users screen.
-
You will be prompted for the following information:
-
First Name — (Optional) The user's given name
-
Last Name — (Optional) The user's surname
-
User Name — The login name for the user
-
Email — The user's e-mail address (mailable from the Delphix Masking Engine server for purposes of job completion e-mail messages)
-
Password — The password that the Delphix Masking Engine uses to authenticate the user on the login page. The password must be at least six characters long but no longer than 12 characters, and contain a minimum of one uppercase character, one wild character (!@#$%^&*), and one number.
-
Confirm Password — Confirm the password with double-entry to avoid data entry errors.
-
Administrator — (Optional) Select the Administrator checkbox if you want to give this user Administrator privileges. (Administrator privileges allow the user to perform all Delphix Masking Engine tasks, including creating and editing users in the Delphix Masking Engine.) If you select the Administrator checkbox, the Roles and Environments fields disappear because Administrator privileges include all roles and environments.
-
Role — Select the role to grant to this user. The choices here depend on the custom roles that you have created. You can assign one role per user name.
-
Environment — Enter as many environments as this user will be able to access. Granting a user access to a given environment does not give them unlimited access to that environment. The user's access is still limited to their assigned role.
-
-
When you are finished, click Save.
Note
When a user is created, it's Account Status is Active by default.
To create a new user using the Masking API follow these steps:
-
Access the API client on your Masking Engine, from http://myMaskingEngine.myDomain.com/masking/api-client.
-
Login into the Masking Engine and select the User endpoint.
|
-
Click Create users at the upper right of /users section and refer to the Example Value for parameters required for new users.
|
-
Enter valid User creation JSON in the body section, refer to sample create users JSON.
-
Click on Execute API Request.
Updating A User¶
To update a user information using Masking UI follow these steps:
-
Login into the Masking Engine and select the Admin tab.
-
Select the Edit icon next to the user you want to edit. The Edit User screen will appear with existing user details.
-
Following user information can be modified through the Edit User screen:
-
First Name
-
Last Name
-
Email Address
-
Password
-
Administrator Status
-
Welcome Page Status
-
Account Status (cannot be changed to Locked)
-
User Roles (non admin users only)
-
User Environments (non admin users only)
-
-
When you are finished, click Save.
Note
User's Account Status will be automatically changed to Locked on multiple invalid login attempts.
To update a user information using Masking API follow these steps:
-
Access the API client on your Masking Engine, from http://myMaskingEngine.myDomain.com/masking/api-client.
-
Login into the Masking Engine and select the User endpoint.
|
-
click Update user by ID at the upper right of section and refer to the Example Value for parameters required for new users.
-
Enter valid User creation JSON in the body section, refer to sample create users JSON.
-
Click on Execute API Request.
Deleting A User¶
To delete a user using the Masking UI follow these steps:
-
Login into the Masking Engine and select the Admin tab.
-
Select the Delete icon next to the user you want to delete.
|
-
In the confirmation box select OK.
To delete a user using Masking API follow these steps:
-
Access the API client on your Masking Engine, from http://myMaskingEngine.myDomain.com/masking/api-client.
-
Login into the Masking Engine and select the User endpoint.
|
-
Click Delete user by ID at the upper right of /users section.
|
-
Enter the userID for the user to be deleted
-
Click on Execute API Request