Administrator journey ===================== This chapter is for platform administrators (members of ``platform-admins``). Everything a data engineer can do is described in :doc:`data-engineer`; here you find what the **Admin** menu adds. Signing in and the administration menu -------------------------------------- Open ``https://.security.datafoundation.eu`` and sign in (see :doc:`introduction`). As an administrator you see an extra **Admin** menu in the top bar. Open it: .. image:: /_static/img/user-manual/admin/01-beheer-menu.png :alt: The Security Center dashboard with the Admin menu open, showing User management, Product sync and Unity Catalog :width: 700px - **User management**: create users, give users a platform role and add users to a team. - **Product sync**: bring the catalog and Security Center in line with each other. - **Unity Catalog**: the rules for creating catalogs and the requests that wait for your decision. Creating a user --------------- Open **Admin** > **User management**. The page has three cards: **Create user**, **Add to team** and **Roles**. .. image:: /_static/img/user-manual/admin/02-gebruikersbeheer.png :alt: The User management page with the three cards Create user, Add to team and Roles :width: 700px 1. In the card **Create user**, fill in the **Username** and the **Email** address of the new user. The user signs in with this e-mail address. .. image:: /_static/img/user-manual/admin/03-gebruiker-aanmaken.png :alt: The card Create user with a user name and an e-mail address filled in :width: 700px 2. Leave **Require password reset on first login** checked, so the user has to choose their own password. Choose **Create user**. 3. The page shows the new user and a **Temporary password**. It is shown only once: copy it now and hand it to the user in a safe way. .. image:: /_static/img/user-manual/admin/04-gebruiker-aangemaakt.png :alt: The card Create user after creating a user, with the temporary password hidden :width: 700px .. note:: The user changes the temporary password and fills in a first and last name at the first sign-in, see :doc:`introduction`. There is no "forgot password" function: if someone loses their password, ask the platform administrator of your organization to set a new one. Making someone an administrator ------------------------------- Every user has a platform role: ``platform-users`` for everybody and ``platform-admins`` for administrators. You change roles in the card **Roles**: 1. Type a few letters of the name or e-mail address in **Search user (username or email)** and pick the user from the list. 2. The roles of the user appear as check boxes. Tick **platform-admins** to make the user an administrator, or clear it to take the role away. The change is saved at once; the message **Role granted** or **Role revoked** confirms it. .. image:: /_static/img/user-manual/admin/05-rollen.png :alt: The Roles card showing the roles platform-admins and platform-users of a selected user :width: 700px .. note:: A change applies the next time the user signs in (the card says so). You cannot take your own administrator role away, and the last administrator always stays. Teams ----- A team is the group of people that owns data products and asks for access to the products of other teams. Teams are listed under **Teams** in the top bar. Creating a team ~~~~~~~~~~~~~~~ 1. Open **Teams**, choose the menu with the three dots at the top right and choose **Create team**. .. image:: /_static/img/user-manual/admin/06-teams-menu.png :alt: The Teams page with the menu open and the entry Create team :width: 700px 2. Enter a **Team name** and a **Contact**: the e-mail address people can write to about this team. The contact is filled in with your own address; replace it if the team has its own. Choose **Save**. .. image:: /_static/img/user-manual/admin/07-team-aanmaken.png :alt: The Create team dialog with a contact address and a team name :width: 700px 3. The team appears in the list. You are its first member, because you created it. .. image:: /_static/img/user-manual/admin/08-team-aangemaakt.png :alt: The Teams page with the new team and the message Team created :width: 700px The overview shows, for each team, its members and the name of its group: .. image:: /_static/img/user-manual/admin/09-teams-overzicht.png :alt: The Teams page with two teams, their members and their group names :width: 700px Adding members to a team ~~~~~~~~~~~~~~~~~~~~~~~~ 1. Select the team in the list. The team page shows the members, the applications that belong to the team and the permissions the team has. Open the menu with the three dots and choose **Add member**. .. image:: /_static/img/user-manual/admin/10-team-menu.png :alt: A team page with the menu open: Add member, Add application and Delete team :width: 700px 2. Enter the e-mail address of the user in **Member**, or the name of a group, and choose **Save**. .. image:: /_static/img/user-manual/admin/11-leden-toevoegen.png :alt: The Add member dialog with an e-mail address in the Lid field :width: 700px 3. The user is listed as a member. **Remove** takes a member out of the team again. .. image:: /_static/img/user-manual/admin/12-team-met-leden.png :alt: A team page with two members, each with a Remove button :width: 700px .. tip:: Only members of a team can change its members on the team page, so make sure you are a member of the teams you set up (the person who creates a team is its first member). As an administrator you can also use the card **Add to team** on the **User management** page: it adds the user to the member list and the access of the team, whether or not you are a member yourself. **Remove from team** takes the user out again. Deleting a team ~~~~~~~~~~~~~~~ Choose **Delete team** in the menu of the team page and confirm. Check first which data products the team owns: a deleted team can no longer manage them. Unity Catalog settings ---------------------- Open **Admin** > **Unity Catalog**. The page has four parts: **Create requests**, **Creation policy**, **Container catalogs** and **Delete catalog**. .. image:: /_static/img/user-manual/admin/13-unity-catalog.png :alt: The Unity Catalog page with Create requests, Creation policy and Container catalogs :width: 700px The **Creation policy** decides who may create what. Each field has a default, shown below the field; a value equal to the default follows the platform's default from now on. .. list-table:: :header-rows: 1 :widths: 28 50 22 * - Field - What it decides - Default * - **Product catalog** - Who may create a catalog that a team owns as a data product. - **Teams, after approval** * - **Container catalog** - Who may create a container catalog: a catalog of the platform in which teams make their own schemas as products, for example ``bronze``, ``silver`` and ``gold``. - **Platform admins only** * - **Schema product in a container** - Who may create a schema product in a container catalog. - **Teams, directly** * - **Creating schemas in a product catalog (Spark)** - Who may create schemas with Spark in a catalog that a team owns. - **Owners and writers** Two more fields restrict names. **Name pattern (regex)** is the pattern every catalog and schema name must match (by default: lower-case letters, digits and underscores, starting with a letter, 2 to 63 characters). **Reserved names** is the list of names nobody may use (by default ``information_schema``, ``main`` and ``system``). Choose **Save** to save your changes. Under **Container catalogs** you create container catalogs (**New catalog**) and name their stewards (**Add steward**): the people who look after a container. Approving or rejecting a request to create a catalog ---------------------------------------------------- When the policy says *after approval*, a request to create a catalog waits for you in **Create requests**. Teams make such a request with **New catalog**, see :doc:`data-engineer`. 1. Open **Admin** > **Unity Catalog**. The request is listed with the kind (**Kind**), the name (**Location**), the owner team, who asked (**Requested by**) and the reason the team gave. .. image:: /_static/img/user-manual/admin/14-aanmaakverzoek.png :alt: The Unity Catalog page with a pending request to create the catalog finance :width: 700px 2. Check the name and the owner team. Choose **Approve** or **Reject**. You can write a reason in the field **Reason** first; the requester sees it. 3. After you approve, the page says **Approved and created**. The catalog now exists and the owner team can start filling it. .. image:: /_static/img/user-manual/admin/15-aanmaakverzoek-goedgekeurd.png :alt: The Unity Catalog page after approving, with no requests left and the message Approved and created :width: 700px Deleting a catalog ------------------ Open **Admin** > **Unity Catalog** and go to the card **Delete catalog**. Use it to remove a catalog that nobody needs any more, for example after a trial. .. image:: /_static/img/user-manual/admin/17-catalogus-verwijderen.png :alt: The card Delete catalog with the catalog analytics selected and its name typed as confirmation :width: 700px 1. Choose the catalog in **Catalog**. 2. Type the name of the catalog again in **Type the catalog name to confirm**. The button **Delete catalog** stays grey until the name is exactly right. 3. Choose **Delete catalog**. The page says that the catalog is deleted. Deleting a catalog removes the catalog with its empty schemas, its data product and every role, request and rule on it, and its catalog in the SQL endpoint (Trino). Know the limits: - A catalog that still has tables is not deleted. The message names the tables. Drop them first, for example in a notebook; Security Center never deletes data itself. - The catalogs ``system`` and ``main`` are protected and cannot be deleted here. The same goes for ``information_schema``. - Deleting cannot be undone. Synchronizing the Unity Catalog ------------------------------- Open **Admin** > **Product sync** and choose **Sync Unity Catalog**. The synchronization registers catalogs that exist in Unity Catalog but that Security Center does not know yet as unassigned products, and makes the rights on each catalog match the approved access requests for the current members of each team. .. image:: /_static/img/user-manual/admin/16-product-synchronisatie.png :alt: The Product sync page with the button Sync Unity Catalog and two empty tables :width: 700px - Run it when something looks out of step, for example after the SQL endpoint was restarted or after someone created catalogs outside Security Center. - Afterwards read the result message: it reports what was newly discovered, what is missing and what failed. - **Unowned products** lists catalogs that no team owns yet; a team can adopt them. **Products that failed to provision** lists products that failed to provision, with the error message; you can delete them there. Checking who has access to something ------------------------------------ Open the **Catalog**, select any catalog, schema or table and open the tab **Access**. It shows where the access comes from along the path from the catalog down to the item, and lists every team and role that has access, including access inherited from higher up in the tree. See :doc:`data-engineer`.