Cloudera Docs

Cloudera DataFlow authorization

As a security administrator with the PowerUser role, you must assign one or more Cloudera DataFlow roles to a user to allow the user to perform tasks in the Cloudera DataFlow Catalog, the Cloudera DataFlow environment, and the Apache NiFi cluster.

Review each of the following Cloudera DataFlow roles to determine which roles a user requires:

DFCatalogViewer
This role allows a user to perform the following tasks:
  • View and search flow definitions in the Cloudera DataFlow Catalog
  • View and search ReadyFlows in the ReadyFlow Gallery
DFCatalogAdmin
This role allows a user to centrally manage flow definitions and ReadyFlows.
A user with the DFCatalogAdmin role can perform the following tasks in the Cloudera DataFlow Catalog:
  • View and search flow definitions
  • Import flow definitions
  • Import new versions of existing flow definitions
  • View flow definition details
  • Delete flow definitions
A user with the DFCatalogAdmin role can perform the following tasks in the ReadyFlow Gallery:
  • View and search ReadyFlows
  • Add ReadyFlows to the Catalog
DFAdmin
This role allows a user to manage the lifecycle of a Cloudera DataFlow environment.
A user with the DFAdmin role can perform the following tasks:
  • Enable a Cloudera environment for Cloudera DataFlow
  • View an environment
  • View environment details and Cloudera DataFlow Settings
  • Disable an environment
  • Update resource roles
  • Grant remote access to an environment
  • Revoke remote access to an environment
  • Terminate all running deployments when disabling the Cloudera DataFlow service for an environment.
A user with the DFAdmin and PowerUser roles can perform the following additional tasks:
  • Assign the DFAdmin role to other users
  • Revoke the DFAdmin role from other users
DFFlowAdmin
This role allows a user to manage flow deployments in a Cloudera DataFlow environment. In addition, this role together with either the DFCatalogViewer or DFCatalogAdmin role allows the user to deploy flows.
A user with the DFFlowAdmin role alone can perform the following tasks:
  • View a deployment on the dashboard
  • View deployment details and settings
  • View a deployment in NiFi
  • Stop a deployment in NiFi
  • Suspend a deployment in NiFi
  • Terminate a deployment in NiFi
  • Change NiFi version
A user with the DFFlowAdmin and PowerUser roles can perform the following additional tasks:
  • Assign the DFFlowAdmin and DFFlowUser roles to other users
  • Revoke the DFFlowAdmin and DFFlowUser roles from other users
A user with the DFFlowAdmin role and either the DFCatalogViewer or DFCatalogAdmin role can perform the following additional task:
  • Deploy flow definitions
DFFlowUser
This role allows a user to view, search, and monitor flow deployments in a Cloudera DataFlow environment.
A user with the DFFlowUser role can perform the following tasks:
  • View a deployment on the dashboard
  • View deployment details and settings
  • View a deployment in NiFi
DFDeveloper
This role allows a user to view, search, create, and manage drafts in Flow Designer on environment level.
A user with the DFDeveloper role can perform the following tasks:
  • Create a new draft
  • View all drafts in an environment
  • View all draft details and settings in an environment
  • Update all drafts in an environment
  • Start and end Test Sessions for any draft in an environment
  • Delete any draft in an environment
A user with the DFDeveloper and the DFCatalogViewer or DFCatalogAdmin roles can perform the following additional tasks:
  • Create drafts from flow definitions in the Cloudera DataFlow Catalog
  • Create drafts from ReadyFlows in the ReadyFlow Gallery
  • Publish drafts as flow definitions to the Catalog (DFCatalogAdmin only)
DFProjectsAdmin
This role allows a user to centrally manage Projects.
A user with the DFProjectsAdmin role can perform the following tasks in a tenant:
  • View and create Projects.
  • Edit users and groups assigned to Projects.
  • Delete Projects.
DFProjectCreator
This role allows a user to create and manage Projects on environment level.
A user with the DFProjectCreator role can perform the following tasks:
  • Create a Project.
  • Edit a Project.
  • Manage users and groups assigned to a Project.

For information on configuring Cloudera user management, see User Management.