Roles and Permissions

Roles enable you to perform Data Collector tasks. Every user requires at least one role to access Data Collector.

When using file-based authentication, you must assign at least one role to each user.

When using LDAP authentication, you can assign roles to users or groups. If the user belongs to a group, any roles associated with the group are granted to the user in addition to the roles assigned directly to the user.

Pipeline permissions determine the access that users have to a pipeline. The owner of the pipeline and users with the Admin role have full access to a pipeline. As a pipeline owner or a user with the Admin role, you can also assign pipeline permissions to individual users and to groups.

To perform pipeline-related tasks, you must have the appropriate pipeline permissions as well as the role associated with the task. For example, a user with the Guest role can only view a pipeline when granted read permission for it. Similarly, to edit a pipeline with a Creator role, you need both read and write permission on the pipeline.

To easily enable pipeline access to sets of users, grant permissions to groups. For example, say you have five users who require read and execute access to run several pipelines. To allow this, you must share each pipeline with each of these users. But if the users are in a single Operations group, you can simply assign read and execute access to the Operations group instead of assigning the permissions to each user individually.

To use pipeline permissions, enable the pipeline.access.control.enabled Data Collector configuration property, and configure the permissions on a pipeline-by-pipeline basis.

By default, the pipeline.access.control.enabled property is disabled. When pipeline permissions are disabled, access to pipelines is based on the roles assigned to the user and its groups.

You can configure the following pipeline permissions:

For details about sharing pipelines with users and groups, see Sharing a Pipeline.

Performing Data Collector tasks generally requires a combination of roles and permissions. The following table outlines the requirements to perform common tasks.

You can transfer pipeline permissions from a user or group to another user or group. When you transfer permissions, all pipeline permissions are passed to the target user or group. Pipeline ownership transfers only from a user to another user.

Transfer permissions when a user account or group becomes obsolete, such as when a user leaves the company or when you register Data Collector with StreamSets Control Hub. You might also transfer permissions when a user changes positions within the company.

For example, say a JD user account belongs to a pipeline developer who has created several pipelines and is now transitioning to operations. As the pipeline creator, JD has full rights to the pipelines that she created. The pipelines are about to go into production, so she needs read and execute permission to run the pipelines, but she should no longer be able to edit them.

To handle this situation, you can transfer all permissions associated with the JD account to another development user or a development group. Then assign JD to an Ops group with the Manager role and assign the Ops group the read and execute permissions for the pipelines they need to run. Or, without an Ops group, you simply assign the Manager role to the JD user account and edit the pipeline permissions to grant read and execute permissions to JD.

When you transfer permissions, the Transfer User and Group Permissions dialog box lists any users or groups that no longer exist but are still associated with pipeline permissions. This allows you to easily transfer permissions from obsolete users and groups.