Role Based Access Control in Astera
In many business scenarios, the Astera client is used by multiple users within an organization, each with a different skill set and job role. Addressing the need for security and access control in such cases, we have implemented a robust role-based security control mechanism in Astera that enables administrators to define user roles and assign all the resources they need.
Default User Roles and Assigned Resources
Astera is shipped with three standard roles, each with a pre-defined level of access to resources. These roles are Root (Super User), Developer, and Operator. Each role has access to a set of URLs (REST APIs) and UI Commands relevant to the type and nature of their job. The URLs allow accessing the feature/functionality via a REST API call. Whereas the UI commands allow users to see the enabled features and functionalities on the client UI
The permissions and access can be modified for each role by a Super User with admin privileges. Moreover, new roles can be created with custom permission sets. A new role can be quickly created by copying the permissions of an existing role, which greatly simplifies a custom security setup.
Here are the three default role types described in detail:
Root (Super User or Admin)
The Super User has complete access to all types of resources available via REST API URLs and the client user interface (also known as UI commands). The Super User also has the administrative authority to create, edit, and modify other roles as well as grant, revoke, or customize access to available resources. You can assign Super User (Root) access to more than one user in Astera.
Developer
This role has access to all the APIs and commands required for designing ETL and ELT flows, workflows, report mining, query writing and editing, XML editor, mapping editor, data validation and profiling, as well as deployment. This is to allow users with developer access to design, modify, schedule dataflows, workflows, and deploy projects on the server. Moreover, they can modify other scheduled jobs on the server but do not have permission to delete them. Some of the resources assigned to the Developer role by default are listed below:
REST API URLs
Jobs
Schedules
Cluster
Events
Deployments
Preview
Event
Functions
Partial access to DB and ServerInfo APIs
Commands
Design Tools
Dataflow – Commands to execute dataflows, create new dataflows and subflows
Workflow – Workflow UI commands such as Execute, Stop, Pause, etc.
QueryEditor – Query editor commands for foreign/primary key drop, key script create key script drop, create a new query, open query, connect or change connection, increase/decrease indent, execute, etc.
XMLEditor – XML editor commands to format, create new XML/XSD files, new text files, load, clear, and generate schemas
Monitoring UI
Trace – Job trace commands to show error info, export trace, find error, error navigation, show SQL statement, etc.
Output Control – Clear output command
ServerMonitor – Commands for Server Monitor features
Server Log – Commands for server activity and jobs run
JobStatus – Workflow job monitor command
Mapping Commands
dbConnectionMapsCommands – Database connection maps commands such as add, remove, edit, etc.
ServerPathMapping – Add, Delete, Save, Export, and Import server path mapping
MapProperties – Commands for different mapping types and properties (one-to-one, one-to-many, many-to-one)
MapEditor – Mapping commands
Scheduler
ScheduleFile – Schedule new file command
Scheduler – Commands to add, run, remove, save, refresh, import, or export a scheduled task
SchedulerLog – Scheduler log refresh and delete all commands
Operator
The Operator role has been designed for a user responsible for deploying, scheduling, and monitoring jobs to run on the target server. An Operator, by default, is assigned the least level of access presets compared to other role types. They have permission to access commands and REST APIs required to view and export job traces, refresh job lists, manage and track runtime instances of jobs, and execute jobs scheduled on the server.
The Operator role, by default, has access to the following resources:
REST API URLs
Schedules
Events
Deployments
Partial access to Account, Jobs, Cluster, and Server APIs
UI Commands
Output Control
Deployment
Scheduler
Partial access to File, Window, QueryEditor, Trace, Server, Server Monitor, and QueryPreview
Accessing Resources Assigned to a Role
A user with ROOT access has the ability to add, edit, or restrict access to resources for any role. To access resources assigned to a role, right-click on any Role in the Role Management window and select Edit Role Resources from the context menu. You can open the Role Management window by going to Server Explorer > right-click DEFAULT > Role List.
Here, we are accessing resources assigned to the DEVELOPER role.
This will open a new window where you can edit and modify resource access for the selected role.
There are two panels on this screen.
The left panel contains two main nodes:
Url:// - Allows accessing the feature/functionality via a REST API call. For instance, ServerInfo can be accessed via the following
REST API call: HTTPS://$servername:9260/api/adm/ServerInfo
Cmd:// - Enables users to see the enabled features and functionalities on the client UI
If we expand these nodes, you can see that the panel contains all the resources available in Astera.
You will see that the resources listed in this panel appear in three different colors. The color scheme distinguishes between what resources have been enabled, disabled, or partially enabled for a role.
Red: Denotes that the resource has been restricted for the role.
Green: Denotes that the resource has been enabled for the role.
Black: Denotes that the resource has been partially enabled, with limited access to some features.
The right panel lists all the resources assigned to a role.
To disable access to a resource, right-click on that resource in the Role Resources panel, and click Disallow.
This will disable the selected resource for the user role. Or you can click the Edit link next to a resource and uncheck the Allowed option, to disable access to a resource.
You can also permit or remove access to resources using these buttons.
URL and CMD Resources Available in Astera
REST API URLs
CMD
File – File menu commands, such as Print, Save, SaveAs, SaveAll, Close, FileExit, etc.
Edit – Edit menu commands, such as Cut, Copy, Undo, Find, etc.
Window – Designer windows, tabs, dockable panels
Context – Context info commands such as copy path, open folder, etc.
View – View menu commands
Tools – Tools menu commands
Browser – Browser commands (Home, Next, Previous, Refresh, Stop)
CloudPath - CloudFilePathCommandConnect
ODBC UI – ODBC UI commands base and connection string commands
ODBCCommands – ODBC drivers and connection string commands
dbConnectionMapsCommands – Database connection maps commands such as add, remove, edit, etc.
ServerPathMapping – Add, Delete, Save, Export, and Import server path mapping
Project – Project-related commands
QueryEditor – Query editor commands
DataModel – Data model commands
EDI – New custom repository, new partner profile
Formats – Format maintenance command
Development – Development commands to write built-in function, localization, reset package and language picker flag, load and save new colors, generate XML for URI-securable and command-securable resources
General Editor – General command toggle binary mode
XmlEditor– XML editor commands
Wizard – Run transfer wizard commands
Workflow – Workflow UI commands such as Execute, Stop, Pause, etc.
Session – Add a new session, execute the session command
Dataflow – Dataflow commands
Packages – SFToCRMPackageCommand
Resource list command – Show details, refresh the resource list
ListEditor – Add, Remove, Save list editor commands
Trace – Job trace commands
JobStatus – Workflow job monitor command
Server – Commands to deploy, schedule, run, and remove jobs on the server
ServerMonitor – Commands for Server Monitor features
Views – Toolbar button edit filter
Output Control – Clear output command
Flow-Flow UI commands
Data Mart Tree – Remove, Add, and Rename data mart tree commands
DataModelBrowser – Commands for Data Model Browser features
EntityList – Base, Select all, Deselect all entity list controls
Data Model Mapping – Data model mapping commands
Data Model Sync – Commands for data model sync maps
DbBrowser2 – Commands for Data Model Browser features
Lineage – Commands for data lineage and impact
LoadSettings – New load settings command
ScheduleFile – Schedule new file command
SharedAction – Create a new shared action command
OLAPViewer – Edit, Refresh, Preview, Print, Show, Stacked, Chart totals commands for OLAP viewer
ReportMining – UI commands for report mining features and functionalities
TextReportPattern – Alpha, Digit, Alpha digit, Whitespace, Non-Blank text report commands
ConditionRules – Add or Remove condition rules
Build Layout – Build output layout command
WizardControlCommand – Next page, Previous page, Go to page commands
Export – Commands to write transfer to Excel
QueryBuilder – Features, and options in query builder (Show Filter, Sort Order, Where Clause, Add and Remove a Filter, Add Sort, Refresh data model)
PickTable – Add tables, Stop add, Select, and Deselect all
CDC Table – Create all, script all CDC table
TableSelection – Table selection commands to show views, select and deselect all
List View – Base, Add, Edit, and Delete commands for list view
AsteraDataGridView – Copy all, Delete, Find, Export to Excel
AsteraUltraGridView – Delete, Find, ExportToExcel
Diagram – Flow diagram commands for auto-layout, Collapse, Expand all, and various types of zooms
Preview – Data preview commands
NodeMetaTree – Add segment, element, or composite element reference, move up and down, add EDI group, delete meta
TransactionMapCommands – Add or Delete transaction maps
EDIPartnerCommands – Commands to generate a test data file
EDIMaintenanceCommands – Save, Delete, Verify an item
EDIValidationRuleCommands– Move EDI validation rules up and down
EDIValidationCommands – Commands to Add, Edit, and Delete EDI validation
LayoutGrid – Copy value to all fields
MapProperties – Commands for different mapping types and properties (one-to-one, one-to-many, many-to-one)
MapEditor – Mapping commands
Object Node – Expand or collapse objects on the designer
Layout Tree – Commands to sort the layout in the alphabetical or original order
Profile – Data profiling commands
QueryPreview – Commands to Show, Copy, and Refresh queries
SortOrder – Add or Remove the sort order
Filter – Filter commands for the query builder
Sequences – Commands to Add, Save, Remove, or Modify sequences
ValidationRules – Data quality commands
Verification – Commands to verify flows before execution
Deployment – Commands to Import, Export, Add, Save, or Remove deployments
PathInfoReplacementCommands – Path info parameter commands for base, ApplyToAll, Discard, SwitchModeToGrouped, and SwitchModeToListView
Scheduler – Commands to Add, Run, Remove, Save, Refresh, Import, or Export a scheduled task
SchedulerLog – Scheduler log refresh and delete all commands
This concludes a round-up of role-based access control in Astera. Click here to read more about how to create a new role and assign resources in Astera.
Last updated
