Roles

Cloudera Data Visualization (CDV) provides URL access to the CDV server object called roles.

To support installations that store the users and groups information outside the CDV environment (such as LDAP), the role membership lists for users and groups only store names. During role update and create operations, CDV accepts user and group names 'as is', without validating them.

Each entry in the privs list corresponds to a single privilege row on the CDV role edit page. Each row contains fields for the privilege type (ptype), an identifier section, and a list of permissions (perms) for the identified objects, such as datasets or data connections. Each privilege type has a specific identifier, and set of possible permissions. CDV stores the dataset IDs and connection IDs within the identifier sections as a STRING and uses the special value -1 to indicate 'All dataset' or 'All connections.

Roles data type

The JSON fields for the roles' data type are defined as follows:

Table 1. JSON fields for the roles data type
Field Detail Only Updatable Description
id No No Role ID
name No Yes Role name
desc No Yes Role description
users No Yes List of usernames that belong to this role
groups No Yes List of groups that belong to this role
privs Yes Yes List of privilege structures for this role, as described in Privileges types

Privileges types

The Cloudera Data Visualization Role-Based Access Control system supports the following permission types:

  • ptype: "system"
    Identifier
    None
    Permissions
    Permission name Description
    sys_editperm Manage roles and users
    sys_styles Manage styles and settings
    sys_viewlogs View query logs
    sys_editconn Manage data connections
  • ptype: "dataconn"
    Identifier
    Field name Description Example
    dclist List of data connection IDs, or -1 for 'All data connections' "dclist" : ["-1"]
    Permissions
    Permission name Description
    dc_aviews Manage analytical views
    dc_upload Import data
    dc_expore Create datasets and explore tables
  • ptype: "dataset"
    Identifier
    Field name Description Example
    dcid Data connection ID for this privilege, or -1 for 'All' "dcid" : "-1"
    dslist List of dataset IDs for this privilege "dslist" : ["1", "2", "3"]
    Permissions
    Permission name Description
    dc_aviews Manage analytical views
    dc_upload Import data
    dc_expore Create datasets and explore tables

Creating roles

The following code creates a new role with groups dataconn_managers and arcviz_admins. The role has system-level permissions to view logs, and to create new datasets. It also has full permissions on all connections and all datasets.

The actual API Key and the method of retrieving the key depends on the user system.

curl -s \
 -X POST \
 -H "Content-Type: application/x-www-form-urlencoded" \
 -H "Authorization: apikey api_key" \
 -d 'data=[{
      "name": "Connection manager",
      "desc": "Data connection management",
      "groups": ["dataconn_managers", "arcviz_admins"],
      "privs": [
          {"ptype": "system",
           "perms": ["sys_viewlogs", "sys_editconn"]
          },
          {"ptype": "dataconn",
           "dclist": ["-1"],
           "perms": ["dc_aviews", "dc_upload", "dc_explore"]
          },
          {"ptype": "dataset",
           "dcid": "-1",
           "dslist": ["-1"],
           "perms": ["ds_manage", "ds_appedit", "ds_appview"]
          }
       ]
   }]' \
 127.0.0.1:7999/arc/adminapi/roles

When viewing this role through the CDV user interface, it appears on the edit page like this: