Managing administrator access
Administration is performed by the grouping of users into user groups and granting administration permissions to those groups; refer to Managing group access for an introduction to user groups including creation of groups and adding users to groups.
User administration
User groups can have the following user administration permissions:
Permission type | Access granted |
---|---|
GRANT |
Users in that group can use group-permission-grant and group-permission-revoke . Refer to Granting user administration permissions to groups |
MODIFY |
Users in that group can use group-create , group-delete , group-add-user , group-remove-user and group-all-remove-user . Refer to Group Management |
VIEW |
Users in that group can use group-list and group-permission-list . Refer to Listing user administration permissions |
Note that users with GRANT
and/or MODIFY
automatically get VIEW
access as well.
Granting user administration permissions to groups
Use the following command to grant access to a group:
geospock group-permission-grant --group-name <group_name> --grant-type <grant-type>
Say, for example, that you want to give the GRANT
permission to group userAdminGroup
, you would use the following command:
geospock group-permission-grant --group-name userAdminGroup --grant-type GRANT
{
"entityId": "userAdminGroup",
}
The optional arguments --subject-group-name <group-name>
and --all-subject-groups
have default values which are
currently the only values supported.
For more information about this command, use the GeoSpock CLI's help
command.
This command requires user administration GRANT
permissions for the user running the command.
Listing user administration permissions
Use the following command to list all user administration permissions for a group, a user or for all groups/users:
geospock group-permission-list --group-name <group-name> | --username <username>
Either --group-name
or --username
should be used, but not both. If neither is provided, all user administration
permissions are returned.
Say, for example, that you want to view the user administration rights of user user.admin@example.com
, you would use
the following command:
geospock group-permission-list --username "user.admin@example.com"
{
"subjectGroupName": "*",
"permissions": [
"grantType": "MODIFY",
"entitiesWithAccess": [
"userAdmins"
]
]
}
This shows that user user.admin@example.com
has MODIFY
access through being a member of group userAdmins
.
Dataset administration
Schema-wide permissions
User groups can have the following schema-wide dataset administration permissions:
Permission type | Dataset specified | Access granted |
---|---|---|
GRANT |
* |
Users in that group can use dataset-permission-grant and dataset-permission-revoke for the default schema or any dataset in the default schema. Refer to Granting dataset administration access to groups |
MODIFY |
* |
Users in that group can use dataset-create , dataset-delete and dataset-add-data . Refer to Ingesting source input data |
VIEW |
* |
Users in that group can use dataset-list and dataset-permission-list . Refer to Granting dataset administration access to groups |
READ |
* |
Users in that group can access all datasets in the default schema via the Presto CLI or a BI Tool integration. |
Here the *
dataset refers to all datasets in the default schema. This is specified by using the --all-datasets
flag when granting permissions.
Note that users with GRANT
and/or MODIFY
automatically get VIEW
access as well.
Dataset-level permissions
User groups can have the following dataset-level administration permissions:
Permission | Dataset specified | Access granted |
---|---|---|
READ |
<dataset name> |
Users in that group can access the specified dataset in the default schema via the Presto CLI or a BI Tool integration. |
Currently, dataset-level MODIFY
, GRANT
and VIEW
access is not supported.
Granting dataset permissions to groups
Use the following command to grant schema-wide access to a group:
geospock dataset-permission-grant --group-name <group_name> --grant-type <grant-type> --all-datasets TRUE
Say, for example, that you want to grant the schema-wide GRANT
permission to group datasetAdminGroup
, you would use
the following command:
geospock dataset-permission-grant --group-name userAdminGroup --grant-type GRANT --all-datasets TRUE
{
"entityId": "userAdminGroup",
}
To grant READ
permissions to a dataset to a group, refer to Adding permissions to your ingested data
For more information about this command, use the GeoSpock CLI's help
command.
This command requires user administration GRANT
permissions for the user running the command.
Listing dataset permissions
The permissions for a particular dataset (both schema-wide and as dataset-level) are returned as part of a
dataset-status
command; refer to Getting information about a dataset
Use the following command to list all dataset administration permissions for a group, a user or for all groups/users:
geospock dataset-permission-list --group-name <group-name> | --username <username>
Either --group-name
or --username
should be used, but not both. If neither is provided, all dataset administration
permissions are returned.
Say, for example, that you want to view the dataset administration rights of user dataset.admin@example.com
, you would
use the following command:
geospock dataset-permission-list --username "dataset.admin@example.com"
{
"schemaName": "default",
"datasetName": "*",
"permissions": [
"grantType": "MODIFY",
"entitiesWithAccess": [
"datasetAdmins"
]
]
}
This shows that user dataset.admin@example.com
has MODIFY
access to all datasets in the default
schema
through being a member of group datasetAdmins
.