Permissions Overview
You manage user security with privileges and permissions. Permissions define the level of access that users and groups have to an object.
Even if a user has the privilege to perform certain actions, the user may also require permission to perform the action on a particular object.
For example, a user has the Manage Services domain privilege and permission on the Development PowerCenter Repository Service, but not on the Production PowerCenter Repository Service. The user can edit or remove the Development PowerCenter Repository Service, but not the Production PowerCenter Repository Service. To manage an application service, a user must have the Manage Services domain privilege and permission on the application service.
You use different tools to configure permissions on the following objects:
You use different tools to configure permissions on the following objects:
Object Type | Tool | Description |
|---|
Connection objects | Administrator tool Analyst tool Developer tool | You can assign permissions on connections defined in the Administrator tool, Analyst tool, or Developer tool. These tools share the connection permissions. |
Data Analyzer objects | Data Analyzer | You can assign permissions on Data Analyzer folders, reports, dashboards, attributes, metrics, template dimensions, and schedules. |
Domain objects | Administrator tool | You can assign permissions on the following domain objects: domain, folders, nodes, grids, licenses, application services, and operating system profiles. |
Metadata Manager catalog objects | Metadata Manager | You can assign permissions on Metadata Manager folders and catalog objects. |
Model repository projects | Analyst tool Developer tool | You can assign permissions on projects defined in the Analyst tool and Developer tool. These tools share project permissions. |
PowerCenter repository objects | PowerCenter Client | You can assign permissions on PowerCenter folders, deployment groups, labels, queries, and connection objects. |
SQL data service objects | Administrator tool | You can assign permissions on SQL data objects, such as SQL data services, virtual schemas, virtual tables, and virtual stored procedures. |
Web service objects | Administrator tool | You can assign permissions on web services or web service operations. |
Object Type | Tool | Description |
|---|
Connection objects | Administrator tool Developer tool | You can assign permissions on connections defined in the Administrator tool or Developer tool. These tools share the connection permissions. |
Domain objects | Administrator tool | You can assign permissions on the following domain objects: domain, folders, node, and application services. |
Model repository projects | Developer tool | You can assign permissions on projects defined in the Developer tool. |
You can use the Administrator tool to configure permissions on a domain object. You can assign permissions on the following domain objects:
- •domain
- •node
- •application services
Types of Permissions
Users and groups can have the following types of permissions in a domain:
- Direct permissions
- Permissions that are assigned directly to a user or group. When users and groups have permission on an object, they can perform administrative tasks on that object if they also have the appropriate privilege. You can edit direct permissions.
- Inherited permissions
Permissions that users inherit. When users have permission on a domain or a folder, they inherit permission on all objects in the domain or the folder. When groups have permission on a domain object, all subgroups and users belonging to the group inherit permission on the domain object. For example, a domain has a folder named Nodes that contains multiple nodes. If you assign a group permission on the folder, all subgroups and users belonging to the group inherit permission on the folder and on all nodes in the folder.
Permissions that users inherit. When users have permission on a domain, they inherit permission on all objects in the domain. When groups have permission on a domain object, all subgroups and users belonging to the group inherit permission on the domain object.
Permissions that users inherit. When users have permission on a domain, they inherit permission on all objects in the domain. When groups have permission on a domain object, all subgroups and users belonging to the group inherit permission on the domain object.
You cannot revoke inherited permissions. You also cannot revoke permissions from users or groups assigned the Administrator role. The Administrator role bypasses permission checking. Users with the Administrator role can access all objects.
You can deny inherited permissions on some object types. When you deny permissions, you configure exceptions to the permissions that users and groups might already have.
- Effective permissions
- Superset of all permissions for a user or group. Includes direct permissions and inherited permissions.
When you view permission details, you can view the origin of effective permissions. Permission details display direct permissions assigned to the user or group, direct permissions assigned to parent groups, and permissions inherited from parent objects. In addition, permission details display whether the user or group is assigned the Administrator role which bypasses permission checking.
Permission Search Filters
When you assign permissions, view permission details, or edit permissions for a user or group, you can use search filters to search for a user or group.
When you manage permissions for a user or group, you can use the following search filters:
- Security domain
- Select the security domain to search for users or groups.
- Pattern string
- Enter a string to search for users or groups. The Administrator tool returns all names that contain the search string. The string is not case sensitive. For example, the string "DA" can return "iasdaemon," "daphne," and "DA_AdminGroup."
You can also sort the list of users or groups. Right-click a column name to sort the column in ascending or descending order.