Tutorial | Govern roles and permissions#

Let’s learn how to set up roles and permissions in Dataiku Govern. This tutorial will start with simple configurations and become more complex as it goes on.

Caution

This tutorial is for beginners working on a newly installed instance of Dataiku Govern. Any prior modifications to the default roles and permissions may result in conflicts or unexpected behavior in this tutorial.

Objectives#

In this tutorial, you will:

  • Utilize standard roles that are included with Dataiku Govern.

  • Associate roles and permissions to a user and a group.

  • Apply rules associated with standard roles.

  • Create and assign new roles with specific permissions.

Prerequisites#

To complete this tutorial, you will need:

  • A newly installed Dataiku Govern instance (version 12.0 and above).

  • Administrator privileges.

Note

This tutorial includes discussion of blueprints, which are an Advanced Dataiku Govern license feature. Still, standard users still must be familiar with blueprints to complete this tutorial. For information about blueprints, please refer to our reference documentation on advanced definitions.

Getting started#

Before we start working with roles and permissions, we’ll need to create some placeholder users and groups to practice on.

Create a group#

  1. From the Applications menu, select Administration.

  2. In the left menu, click Security.

  3. Switch to the Groups tab of the panel and select + New Group.

  4. Name the group Data_Scientist_YOURINITIALS and click Create. Note that group names must be unique.

  1. From the Launchpad, select Users, Profiles & Groups.

  2. Open the Groups and Permissions tab.

  3. Click + New Group.

  4. Name the group Data_Scientist_YOURINITIALS.

  5. Make sure Govern node is selected under Node Availability.

  6. Click Next.

  7. Under Govern permissions, select the Govern Manager checkbox.

  8. Confirm to save your new group.

Create a user#

Next, we’ll create a new user and add them to the Data Scientist group.

  1. Return to the Users tab and select +New User.

  2. In the Login field, create a unique ID for your test user.

  3. In the Display name field, type Academy User, or something more identifiable.

  4. Select your Data Scientist group in the Groups dropdown.

  5. Choose your own password for this user.

  6. Click Create.

  1. Return to the Users tab and select + Invite Users.

  2. Under Users, create an alias for your own email by adding a + to it: example+@gmail.com

  3. Under Groups, select your Data Scientist group from the dropdown.

  4. Click Send Invites.

  5. You will find a link to sign up in your email. Follow the steps to sign up to activate your new user!

Important

You must sign up using a username and password, rather than single sign-on (SSO). If you don’t see the page to sign up, make sure you are logged out of your own Dataiku Cloud account.

  1. Once you have activated the new user, log out and sign back in to your administrator account.

  2. In the Overview panel, click Open Instance on your Govern Node.

Now we can begin to assign some roles and permissions!

Assign a default role#

In this section, we will assign the standard Reader role to a user. This role only grants Read permissions by default, so users won’t be able to create, edit, or delete anything.

  1. From the Applications menu, select Roles & Permissions.

  2. Navigate to Blueprint-specific settings in the left menu and select Business initiative.

  3. Click Create a Role Assignment Rule.

A Dataiku Govern screenshot showing the Create a Role Assignment Rule button in the user interface.

Let’s configure this role assignment rule to assign the Reader role to your user.

  1. Select Reader in the Assign role field.

  2. In the To users field, find and select your new user.

  3. Click Create.

  4. In the Permissions tab, make sure that the Reader role has read permissions.

A Dataiku Govern screenshot showing the Reader rule configuration in the dialogue box.

With this rule in place, your user will have read permissions for business initiatives. Because business initiatives are at the top of the Govern item hierarchy, this rule will be inherited by Govern projects, models, model versions, and bundles as well. To see a visual schema of artifacts, visit this article on governance layers.

Inheritance#

While role assignment rules are inherited, permissions are not. To add read permissions to all Govern artifacts, you can navigate to the permissions tab in each Blueprint-specific setting. We’ll skip this for now.

Note

To understand role assignments better, read or review this section on defining role assignments.

To see the results of this role assignment, you can either log in to your test user profile and play around, or you can watch our video here:

Create and assign a new custom role#

Dataiku Govern also lets you configure new roles and permissions beyond the built-in standards. Let’s create a new role with specific permissions for your Data Scientist group.

In this case, we want the Data Scientist group to only be able to:

  • Read Govern projects

  • Read and write Govern bundles

  • Read related Dataiku objects

  • Read deployment information

This means that we will have to create role assignment rules for the following blueprints:

Blueprint

Permissions

Business initiative

–

Dataiku project

Read

Govern project

Read

Dataiku saved model

–

Govern model

–

Dataiku saved model version

–

Govern model version

–

Dataiku bundle

Read

Govern bundle

Read and Write

Project deployer deployment

Read

Project deployer infrastructure

Read

API deployer deployment

–

API deployer infrastructure

–

Note

If a user is not associated to a role assignment rule for a certain blueprint, they will have no permissions for that blueprint and will not be able to access it in any way.

Create the custom role#

Let’s create this new role.

  1. Select the Roles tab in the left menu and click + New Role.

  2. Type Data Scientist YOURINITIALS in the name field. The ID field will automatically populate.

  3. Click Create.

A Dataiku Govern screenshot showing the New role dialogue.

Note

Multiple roles can have the same name, but IDs must be unique.

Review role permissions#

Now, take a look at the default permissions for your new role.

  1. Switch to the Default permissions tab in the left menu.

  2. Find the new role in the table. Notice that the default permission is read-only.

A Dataiku Govern screenshot highlighting default permissions for the Data Scientist role.

Assign the new role to a group#

Now you can assign your new role to the Data Scientist group. Let’s do this by configuring the blueprint-specific settings relevant to your requirements.

  1. Navigate to the Blueprint-specific settings tab from the left menu.

  2. Open Dataiku project and click Create a Role Assignment Rule.

  3. Select the Data Scientist role under Assign role.

  4. Choose the Data Scientist group under And/or to groups.

  5. Click Create to save this rule.

A Dataiku Govern screenshot of the new rule for the Data Scientist role.

This assigns the Data Scientist role to the group Data Scientist for Dataiku projects and other blueprints by inheritance. Remember that permissions are not inherited.

Define blueprint-specific permissions#

Next, we’ll configure the permissions in our blueprint-specific settings.

  1. In the Permissions tab, select Edit.

  2. In your Data Scientist row, check the Read boxes under Artifact, blueprint and blueprint version permissions and Field permissions.

  3. Save your changes.

Repeat steps 1-3 in this section to apply rules and read permissions to the following blueprints:

  • Govern project

  • Project deployer deployment

  • Project deployer infrastructure

Define permissions for inherited rules#

Because we just created role assignment rules for the Govern project blueprint and the Dataiku project blueprint, those rules were inherited by other blueprints. Let’s add permissions on a couple of blueprints for the inherited rules.

  1. From the Blueprint-specific settings tab, open Dataiku bundle.

  2. Switch to the Permissions tab and click Edit.

  3. In your Data Scientist row, check the Read boxes under Artifact, blueprint and blueprint version permissions and Field permissions.

  4. Click Save.

A Dataiku Govern screenshot showing the Dataiku bundle blueprint-specific permissions.

Now we’ll apply read and write permissions on Govern bundles.

  1. From the Blueprint-specific settings tab, open Govern bundle.

  2. Switch to the Permissions tab and click Edit.

  3. In your Data Scientist row, check the Read and Write boxes under Artifact, blueprint and blueprint version permissions and Field permissions.

  4. Click Save.

A Dataiku Govern screenshot showing the Govern bundle blueprint-specific permissions.

Nice work! You have successfully assigned a new role with custom permissions. At this point, your user should have the Data Scientist roles and permissions because they are part of the Data Scientist group.

See the results of this assignment for your user: