How to create a new role and users for VDB?

[allenyu6]

Hi all, try ing to figure out how to create role and users for the VDB I created, but get little help from the documents, I only saw what can be done, but I  am not able figure out how to do it. The only thing I figure out is to go to command line to add a app user and it does has all privileges as teiidUser, which is not quite what I want. Any suggestions? Please send me some screenshot or step by step guides. thanks, Allen

[asmigala]

Hi allenyu6 , the user you added using command line is stored in $JBOSS_HOME/standalone/configuration/application-users.properties . In the same directory, there's also a file application-roles.properties, which you can edit to assign roles to users, the format is simple userName=list,of,roles. See EAP documentation for more details.

Once you create the users and assign roles, you can add permissions to the VDB using either Teiid Designer's VDB Editor or, if you are using dynamic VDBs, by adding the appropriate <data-role> elements.

[rareddy]

To add to Andrej's response, typically you do not add users, users are already defined in your Active Directory or LDAP system etc. Even if you are looking at Teiid users as separate, tackle that issue separately. The default security domain is "teiid-security" which works with "application-users.properties" and "application-roles.properties".  If you are looking for adding users programatically, then you may write/extend your login module to fit your needs in extreme cases. But here few questions needs to be answered as what kind of application you are developing and what is the UI for it. There is also a DatabaseLoginModule you should investigate.

Ramesh..

[allenyu6]

I was able to create a user and assign a role called "user", but the problem is it has access same as teiidUser, where and how I change the privilege in the TEIID designer? I try to find it hard, can someone provide a screenshot here?

[allenyu6]

I think we should be able to assign not only privileges on VDB but also the tables, even the columns, but I just can't find it where you can do it in designer..

[asmigala]

The way data roles work is that if you don't specify a data role in the VDB, all models will be accessible to all users. Once you specify at least on data role, only the users which are mapped in the data roles will have the specified permissions.

This is how you assign data roles in Designer:

1. open the VDB editor, switch to Advanced tab and then to Data Roles tab, click the Add button
   
2. Switch to the Mapped Enterprise Role or Group, click Add and set the name of the role you want to assign
   
3. Switch to the Permission tab and setup you model/table/column permissions, column masking or row filtering.

You can find more about the data roles in Teiid documentation: Data Roles - Teiid 9.0 (draft) - Project Documentation Editor