Skip to content

Please refer to the responsibilities and capabilities assignment model for an explanation of how users relate to role assignment.

Global roles are used to assign repository wide responsibilities to users and groups that apply to all objects in the repository.

There are several pre-defined but fully customizable object roles already delivered with the product.

Role Name Type Definition
Security Administrator Producer User and group management
Global Administrator Producer All global administrative capabilities. Created by default on new install and on migrated install for the Administrators group to migrate properly.
Application Administrator Producer Server management capabilities
API User Producer access
Application Designer Consumer Customization of dashboards and presentations and related worksheets and collections
Worksheet Author Consumer Creation, management and editing of worksheets
Collections Custodian Consumer Creation, management and editing of collections
> The list of global roles above are provided by default for new
> installations only. If you have upgraded from an earlier version you may
> not see all of these and may see others which were migrated. You may
> still import the list of global roles above which
> are in the installation path at /conf/Roles/GlobalRoles.csv.

Assignment of the Global Administrator role to a user means that user has all global capabilities within.

Global Roles and Producers vs. Consumers

A concurrent user license can be split in two maximum limits:

  • Metadata producers who are read-write concurrent users such as data architects, data modelers, glossary editors, mapping designers, developers and any advanced users with access to all functionalities.

  • Metadata consumers who are ready-only concurrent users such as data users, analysts, reviewers who can create worksheets/dashboards, add comments/social curation)

With this split license, users are considered to be metadata consumers by default. A user will automatically be designated as a producer, if they have are assigned to any roles with capability assignments that make them a Producer.

If a user is assigned any role of type Producer, then they are counted as a Producer, otherwise if all roles they are assigned are Consumer only, then they are counted as a Consumer.

Similarly, if a role has any capability type Producer, then it is of type Producer, otherwise if all capabilities for that role are Consumer only, then it is of type Consumer.

Consumers are those with global capabilities to only customize collections, worksheets, and dashboards.

Add a Global Role

You may add any number of new global roles.

Steps

  1. Sign in as a user with at least the Security Administrator capability global role assignment.

  2. Go to MANAGE > Global Roles in the banner

  3. Click Add.

  4. Provide Name and Definition.

  5. Use the Capabilities pick list to select capability assignments for the global role.

  6. Select Group assignments from the Users/Group pick list for the global role assignments.

  7. Click OK.

You may create a new role based upon an existing one by using the Duplicate Role context menu item on the existing line.

Example

Sign in as Administrator and go to MANAGE > Global Roles.

Click Add and enter "UI Customization" for the Name and "Users who can create and edit worksheets, dashboards and presentations" in Definition.

Then pick the Application Administration and Worksheet Customization capabilities.

Click CREATE.

The License is of type Producer. This is assigned automatically. If a role has any capability type Producer, then it is of type Producer, otherwise if all capabilities for that role are Consumer only, then it is of type Consumer.

Edit a Global Role

One may change the Name, Definition and Capability assignments for any global role.

The capabilities include:

Capability Name Definition
Security Administrator Allows users to manage security
Application Administration Allows users to administer their server
Worksheet Customization Allows users to create / edit / share their worksheets
Dashboard Customization Allows users to create / edit / share their dashboards
Collection Customization Allows users to create / edit / share their collections
Presentation Customization Allows users to create / edit / share presentations
REST API Access Allows users to use the
Steps
  1. Sign in as a user with at least the Security Administrator capability global role assignment.

  2. Go to MANAGE > Global Roles in the banner.

  3. Select a row and click Edit.

  4. Update Name and Definition.

  5. Use the Capabilities pick list to select capability assignments for the global role.

  6. Select Group assignments from the Users/Group pick list for the global role assignments.

  7. Click OK.

You may simply double-click a cell in the sheet of capabilities vs. roles to set or unset a particular capability assignment (responsibility).

Again, if a role has any capability License type Producer, then it is of type Producer, otherwise if all capabilities for that role are Consumer only, then it is of type Consumer.

Example

Sign in as Administrator and go to MANAGE > Global Roles.

Pick the Application Designer role. Edit the Definition by adding "and API use" to the list of capabilities. Then pick the REST API Access capability.

Click SAVE.

Delete a Global Role

You may delete any global role.

If you delete a role that is already assigned to a user or group then they will lose those capabilities.

Steps

  1. Sign in as a user with at least the Security Administrator capability global role assignment.

  2. Go to MANAGE > Global Roles in the banner.

  3. Select a row and click Delete.

  4. Click OK.

Import Global Roles

You may import global roles from a CSV file.

The format of this CSV file may be determined by first exporting to that format.

Steps

  1. Sign in as a user with at least the Security Administrator capability global role assignment.

  2. Go to MANAGE > Global Roles in the banner.

  3. Click IMPORT.

  4. Browse for a file and click OK.

The import action will produce a log and will update and merge, reporting on the number of roles affected.

Export Global Roles

You may export the list of global roles to a CSV file.

Steps

  1. Sign in as a user with at least the Security Administrator capability global role assignment.

  2. Go to MANAGE > Global Roles in the banner.

  3. Click EXPORT.

  4. The file is pushed to your browser.

You may download either CSV files or XLSX files. The XLSX file have special handling which safeguards against CSV Injection, also known as Formula Injection, which is a security vulnerability that occurs when untrusted input is included in a CSV file.

Check Responsibilities

You may see a list of role assignments for users and groups by going to the respective MANAGE > Users and MANAGE > Groups pages.