Access Management

Note:

This functionality is for Dremio v16.0+ Enterprise Edition only. If you’re using earlier than v16.0+, then view the previous access control functionality at the Users, Groups, and Roles and Sharing and Permissions pages.

• Privileges: Privileges enable users to perform explicit operations on objects in Dremio. Additionally, privileges may be set on individual datasets (tables or views) or whole schemas, allowing for a simplified configuration with larger catalogs. To learn more about the Dremio object model, see Objects in Dremio Cloud.
• Row-access and column-masking policies: Row-access and column-masking policies enable you to grant users access to particular rows or columns.
• Flexible Management: Privileges can be easily configured using GRANT TO USER command, GRANT TO ROLE command, GRANT ROLE command, REST APIs, and an intuitive and easy-to-use user interface.
• Ownership: An object-oriented model allows for a clearly-defined and transferable owner for all aspects in Dremio, including cloud and engine configuration. Users with ownership over an object will automatically retain all privileges necessary to modify the object and read/write its data.
• Users & Roles: Administrators may create and manage identities in Dremio or using external identity providers (IdP).

• Privileges: Privileges enable users to perform explicit operations on objects in Dremio. Additionally, privileges may be set on individual datasets (tables or views) or whole schemas, allowing for a simplified configuration with larger catalogs.
• Row-access and column-masking policies: Row-access and column-masking policies enable you to grant users access to particular rows or columns.
• Flexible Management: Privileges can be easily configured using SQL Commands, REST APIs, and an intuitive and easy-to-use user interface.
• Ownership: An object-oriented model allows for a clearly-defined and transferable owner for all aspects in Dremio, including source and space configuration.
• Local Users & Roles (18.0+): Administrators may create and manage identities in Dremio alongside identities from corporate LDAP or IdP, including standards-based synchronization (SCIM).

• Best Practices
• Privileges
• Roles
• Row & Column Policies
• SCIM
• Users

• Access Management Structure
• Apache Ranger: Row-Level Filtering & Column-Masking
• Dremio-Native: Row-Access & Column-Masking Policies
• Integrating Dremio with Okta
• Privileges
• Roles
• Users
• Best Practices

The following APIs are available for managing access control:

• Grants APIs
• Privileges APIs
• Roles APIs
• Users APIs

• GRANT TO USER
• GRANT TO ROLE
• GRANT ROLE
• CREATE ROLE
• CREATE USER
• REVOKE FROM ROLE
• REVOKE FROM USER
• REVOKE ROLE

• Privileges SQL Commands
• Roles SQL Commands
• Users SQL Commands