The most effective way to understand how to create and apply access policies is to walk through some common examples. The following scenarios assume User1 is an administrator and User2 is a newly added user that has only been given access to the UI.
Let's begin with two processors on the canvas as our starting point: GenerateFlowFile and LogAttribute.
User1 can add components to the dataflow and is able to move, edit and connect all processors. The details and properties of the root process group and processors are visible to User1.
User1 wants to maintain their current privileges to the dataflow and its components.
User2 is unable to add components to the dataflow or move, edit, or connect components. The details and properties of the root process group and processors are hidden from User2.
Moving a Processor
To allow User2 to move the GenerateFlowFile processor in the dataflow and only that processor, User1 performs the following steps:
Select the GenerateFlowFile processor so that it is highlighted.
Select the Access Policies icon () from the Operate palette and the Access Policies dialog opens.
Select "modify the component" from the policy drop-down. The "modify the component" policy that currently exists on the processor (child) is the "modify the component" policy inherited from the root process group (parent) on which User1 has privileges.
Select the Override link in the policy inheritance message. When creating the replacement policy, you are given a choice to override with a copy of the inherited policy or an empty policy. Select the Override button to create a copy.
On the replacement policy that is created, select the Add User icon (). Find or enter User2 in the User Identity field and select OK. With these changes, User1 maintains the ability to move both processors on the canvas. User2 can now move the GenerateFlowFile processor but cannot move the LogAttribute processor.
Editing a Processor
In the "Moving a Processor" example above, User2 was added to the "modify the component" policy for GenerateFlowFile. Without the ability to view the processor properties, User2 is unable to modify the processor's configuration. In order to edit a component, a user must be on both the "view the component" and "modify the component" policies. To implement this, User1 performs the following steps:
Select the GenerateFlowFile processor.
Select the Access Policies icon () from the Operate palette and the Access Policies dialog opens.
Select "view the component" from the policy drop-down. The view the component" policy that currently exists on the processor (child) is the "view the component" policy inherited from the root process group (parent) on which User1 has privileges.
Select the Override link in the policy inheritance message, keep the default of Copy policy and select the Override button.
On the override policy that is created, select the Add User icon (). Find or enter User2 in the User Identity field and select OK. With these changes, User1 maintains the ability to view and edit the processors on the canvas. User2 can now view and edit the GenerateFlowFile processor.
Creating a Connection
With the access policies configured as discussed in the previous two examples, User1 is able to connect GenerateFlowFile to LogAttribute:
User2 cannot make the connection:
This is because:
User2 does not have modify access on the process group.
Even though User2 has view and modify access to the source component (GenerateFlowFile), User2 does not have an access policy on the destination component (LogAttribute).
To allow User2 to connect GenerateFlowFile to LogAttribute, as User1:
Select the root process group. The Operate palette is updated with details for the root process group.
Select the Access Policies icon () from the Operate palette and the Access Policies dialog opens.
Select "modify the component" from the policy drop-down.
Select the Add User icon (). Find or enter User2 and select OK.
By adding User2 to the "modify the component" policy on the process group, User2 is added to the "modify the component" policy on the LogAttribute processor by policy inheritance. To confirm this, highlight the LogAttribute processor and select the Access Policies icon () from the Operate palette:
With these changes, User2 can now connect the GenerateFlowFile processor to the LogAttribute processor.
Editing a Connection
Assume User1 or User2 adds a ReplaceText processor to the root process group:
User1 can select and change the existing connection (between GenerateFlowFile to LogAttribute) to now connect GenerateFlowFile to ReplaceText:
User 2 is unable to perform this action.
To allow User2 to connect GenerateFlowFile to ReplaceText, as User1:
Select the root process group. The Operate palette is updated with details for the root process group.
Select the Access Policies icon ().
Select "view the component" from the policy drop-down.
Select the Add User icon (). Find or enter User2 and select OK.
Being added to both the view and modify policies for the process group, User2 can now connect the GenerateFlowFile processor to the ReplaceText processor.
