PrivaceraCloud Documentation

Table of Contents

About data access users, groups, and roles resource policies
:

The Access Manager > Users/Groups/Roles page is for managing data access users, groups, and roles.

Data access users can be allowed or denied use of data stored in connected applications, as opposed to portal users, who are users that can log into your PrivaceraCloud account.

Users

You use data access users when you define resource policies. Users can be included or excluded specifically or in groups for allowed or denied access

  • The User Source field indicates the method of their creation or import (source).

    • The internal administrative "users": admin, rangerusersync, keyadmin, rangertagsync, and {OWNER} are automatically defined when your PrivaceraCloud account is created. Additional Internal users can also be created in this dialog using the +Add button dialog.

    • External users can be any of the following:

      • A data access user with the same username as the account administrator user.

      • A service user. A service user is automatically created by PrivaceraCloud for each connected application service and is named for the service (e.g. hive, s3, ...). Service names are reserved and cannot be reused.

      • Users imported via UserSync from LDAP or Active Directory.

        See Connect users for information on importing users.

  • The Visibility field indicates if a user record is listed or available when creating or editing a resource policy with Access Manager. If a user record is visible, you can find it under Select User. If a user record is Hidden, it is not selectable. This is useful when your account has been synchronized with a user directory with a large number of users. Visibility can be set by selecting a user object row (on the left side of the table, and using the Visibility action (between +Add and Delete).

  • User Role applies to individual data access users: User, Admin, Auditor, or KeyAdmin}.

Use Search to filter displayed objects by a specific value. First select a column name, then a value.

User objects can be added, edited, or deleted.

Groups

Groups are collections of associated users. Users can be members of more than one group. Similar to user objects, groups are used in definition of resource policies. Groups can be included or excluded specifically or in association with other groups for allowed or denied access.

All functions for users are also available for groups: add/delete, hide/show, and search.

Roles
image72.png

Witgh the Roles tab, you can create custom roles used for use when you define data access policies. Custom roles are distinct from data access imported roles and user roles.

Click +Add New Role to create a new custom role. At least one user, group, or role must be selected. Use the dropdown to select the desired users, groups, or roles. Under the column Is Role Admin, set one or more existing users, groups, or roles to be a role administrator.