Tutorial | User and group management

Get started

Before teams can begin building analytics, models, and agents with Dataiku, the administrator needs to create and manage user and group assignments.

Objectives

In this tutorial, you will:

• Manually create users and groups on the Dataiku instance.

• Distinguish between user profiles and user groups.

• Grant project-level permissions to groups.

• Use the authorization matrix to review user and group permissions globally.

Prerequisites

• Membership in a group with the Administrator permission.

• An available user profile seat on your license, for the test user.

Use case summary

This tutorial walks through creating users and groups by hand. Your organization may never need to do this. If you use LDAP, SSO, or another external identity provider, user authentication and provisioning happens automatically. However, working through the manual process is the clearest way to learn the principles of user and group management that apply regardless of how users arrive on the platform.

Along the way, you’ll build a simple permissions model from scratch: creating groups, assigning global and project-level permissions, and seeing how those layers interact. These fundamentals are the same ones you’ll rely on in any Dataiku deployment.

Important

While the principles are the same, the interface for managing users and groups differs depending on your type of installation. Use the tabs below to follow the correct set of instructions for whether you’re using Dataiku Cloud or a self-managed (Dataiku Cloud Stacks or Custom) installation.

Manage users

At the foundation of any permissions model is the users themselves. Start by getting familiar with a few important properties of a user’s account.

Find your user profile and group assignments

Before you start creating users and groups on behalf of your organization, take a moment to review your own account details.

Dataiku CloudSelf-managed

1. Log in to the Cloud Launchpad.

2. Within the Overview panel, turn on the instance, and on the Design node, click Open Instance.

3. At the top right corner of the Design node, click the user icon.

4. Click the gear icon to see Profile & Settings.

5. You should have a profile (such as Full Designer) and membership in a group called space_administrators.

Tip

The name of your exact profile may differ based on your Dataiku license. For the purpose of this tutorial, the exact name won’t matter. See User profiles in the reference documentation to learn more.

Create or invite a user

Having found your own account details, you’re ready to add users from your organization. For simplicity, add yourself as a second user.

Dataiku CloudSelf-managed

To experience the platform as a new user would, without needing a second mailbox, you can invite yourself using an email subaddress. Think of this user as a test user.

1. From the Launchpad, navigate to the Users & Access Management panel.

2. Click + Invite Users.

3. Send the email to youremail+training@yourdomain.com (note the +training).

4. For the Profile, select full designer.

5. Temporarily, remove all group assignments for this test user.

6. Click Send Invites.

Tip

Some corporate mail systems strip or reject subaddressing. If the invite doesn’t arrive, confirm with your IT team or use a real secondary mailbox instead.

Assign a profile to a user

Regardless of how you retrieve user information, you’ll need to understand the property of user profiles vs. groups. Note that:

• User profiles are a licensing concept.

• User groups are a security mechanism.

The test user you created is a good opportunity to understand this difference.

Dataiku CloudSelf-managed

At this point, the test user has a profile but no group.

1. When you receive the invite link in your email inbox, open it in a private or incognito window to avoid interference with any prior session cookies.

2. Click Accept.

3. Confirm you’re logged in to the Cloud Launchpad, but don’t have access to any actual Dataiku nodes.

Important

Even though the test user in this case has some kind of Designer profile, they can’t design projects. Permissions to perform actions (like creating projects) come from group permissions rather than the profile.

Design a permissions model

To grant permissions to users in a governed and auditable way, the administrator needs to establish groups. Before rushing to do so, first think about designing a permissions model that meets the needs of the organization’s user personas.

For this tutorial, assume your organization has three broad types of users:

• A builder persona (data scientist/analyst/engineer, etc.) that needs a wide range of permissions to perform most actions on the platform.

• A consumer persona that needs a much more limited range of permissions for tasks such as interacting with dashboards and running Dataiku apps.

• An administrator persona that needs all permissions for managing the platform.

Create two groups

While your instance has default groups that could match these personas, start by creating two groups by hand to better understand the process.

Dataiku CloudSelf-managed

1. In the Cloud Launchpad, log in as the admin.

2. Within the Users & Access Management panel, go to Groups & Permissions.

3. Explore the permissions of any default groups.

4. Click + Add Group.

5. Name it test_builders.

6. Provide the description Admin training group for users building projects.

7. Leaving users temporarily empty, click Next.

8. Grant this group the global permission to Create projects.

9. Click Confirm.

Repeat the steps above to create a second group called test_consumers.

1. Be sure members of the second group don’t have the global permission to Create projects. Instead, grant them a right such as the ability to Publish to Data Collections.

2. Click Save or Confirm.

See also

To explore other group permissions, see global group permissions in the reference documentation.

Assign a user to groups

Now your instance has groups that align with the user needs of your organization. To see this in action, these groups need users. To realize the power of group memberships, start by assigning the test user to both groups.

Dataiku CloudSelf-managed

1. Navigate to the Users & Access Management panel.

2. In the row of the test user, click () > Edit User.

3. For the Groups field, assign this user to both test_builders and test_consumers.

4. Click Update.

Group permissions are additive. As long as the test user belongs to one group that has the global permission to create projects, this user will be able to create projects. Confirm this for yourself:

Dataiku CloudSelf-managed

1. Log in as the test user.

2. From the Overview panel of the Cloud Launchpad, click Open Instance in the Design node.

From the Design node, you can create a new project.

1. If needed, from the Dataiku Design homepage, use the () icon to switch to the Designer view.

2. Click + New Project > Learning projects.

3. Search for and select User & Group Management.

4. If needed, change the folder into which the project will be installed, and click Create.

5. From the project homepage, click Go to Flow (or type g + f).

Note

You can also download the starter project from this website and import it as a ZIP file.

Grant project-level permissions

The global group permissions (such as the ability to create projects) apply throughout Dataiku. On top of these, you can also set much finer-grained permissions with respect to an individual project.

Set per-project group permissions

For the current project, grant specific permissions to members of specific groups. In this case, members of test_consumers shouldn’t be able to edit the project. They only need viewing rights.

1. Logged in as the test user, open the User & Group Management project.

2. In the top navigation bar, navigate to More Options () > Security.

3. Under User permissions, open the dropdown Select groups. Choose test_builders and test_consumers, and click + Grant Access.

4. Modify the project-level permissions for each group. Make sure that members of test_builders can Write project content, but that members of test_consumers can only Read project content.

5. Click Save to preserve these changes.

Tip

Notice that some permissions automatically grant others. For example, a group that can Write project content must also be able to Write dashboards. However, the reverse isn’t true.

See also

For the complete list, see per-project group permissions in the reference documentation.

Edit a user’s group memberships

To examine this configuration in action, remove the test user from the test_builders group.

Dataiku CloudSelf-managed

1. In the Cloud Launchpad, log in as the admin.

2. Go to Users & Access Management.

3. In the row of the test user, click () > Edit User.

4. Limit this user’s group membership to only test_consumers (members of which can’t create projects globally and, with respect to the User & Group Management project, can only read content).

5. Click Update.

6. Log back in as the test-user.

7. From the Design homepage, try to click + New Project, and confirm this user lacks the permission to create a new project.

Important

Without membership in a group with the global permission to create projects, the test user now can only access existing projects shared with them.

Transfer project (instance) ownership

Through these few actions, you should have a solid understanding of the key principles for managing users and groups. One last concept to grasp is the role of the project owner, formally known as the instance owner.

Tip

Here “instance” refers to an instance of the project rather than the entire Dataiku instance, or platform.

Despite lacking membership in a group with the permission to write content in the project, the test user actually still retains this right. How? The test user is the instance owner of that project.

The instance owner (by default the user who created the project) has the same permissions as a group with admin rights to the project.

1. Logged in as the test-user, open the User & Group Management project.

2. Navigate to More Options () > Security.

3. Within the Permissions panel, confirm that the test-user is the Instance owner, with their full admin permissions listed in the table.

4. Transfer instance ownership to the admin user.

5. Click the bin () to delete the test-user from the permissions table.

6. Confirm that only the admin user and the test_builders group have the permission to write content in the project.

7. Click Save to preserve the project-level permission changes.

   

8. Still logged in as the test-user, return to the Flow (g + f), and confirm that the test user can’t write content (such as with a visual recipe).

Tip

The owner status is primarily a tool to grant access to a project to the user who just created it. However, beyond this designation, there’s no additional permission beyond any other user in a group with admin rights.

Audit user and group membership

As the platform matures, it’s an administrator’s responsibility to maintain permissions of users and groups. The authorization matrix provides a global view.

1. Log in as the admin.

2. Go to Administration > Security > Authorization Matrix.

3. Above Instance authorization, view By user, and include Test User as a column to view this user’s global permissions.

4. Switch to By group, and do the same for test_builders and test_consumers.

You can do the same at the project level.

1. Within the Authorization Matrix panel, scroll down to Project authorization.

2. Filter for User & Group Management.

3. Compare the project level permissions for members in the test_builders and test_consumers groups, especially the missing WPC (Write project content) permission for test_consumers.

Next steps

This tutorial introduced only the foundations of user and group management. To complete the entire security model, you’ll also need to understand resource permissions.

This class of permissions controls access to data connections, deployment infrastructure, code environments, compute clusters, and more. You’ll learn about the administrator’s role in securing these resources in materials dedicated to the resources themselves.

Important

Before finishing, remember tidiness is the administrator’s responsibility! When finished training, delete:

• The user named test-user

• The groups test_builders and test_consumers

• The project User & Group Management

See also

For more information, consult the reference documentation on topics like permissions.