In Connect AI, privileges are administrative actions, while permissions are data and execution access.
- Administrator has full access to all Connect AI functions, including adding and managing users.
- Connection Administrator can create, edit, and delete connections and workspaces. They can also assign connection and workspace permissions, view users, query all connections, and view connection-related audit log events.
- User Administrator can create, invite, edit, and disable users, assign and revoke the User Administrator and Query roles, and view user-related audit events.
-
Query users can authenticate to a connection with their own credentials, as long as the user and connection meet the following criteria:
- An Administrator or Connection Administrator grants the user permission to use the connection.
- An Administrator selects Per-User Authentication, rather than Shared Authentication, for the connection.
By default, all CData Connect Spreadsheets users have an Administrator role. They have full Select, Insert, Update, Delete, and Execute permissions.
Users
The Users tab contains information about every user in Connect AI.
- The number of user seats that are available on your account.
- A row for every user on your account:
- User displays the email address that is associated with the user.
- Role indicates the user’s system role.
- Status shows the state of the user’s account (Active, Inactive, or Invited).
- Edit and delete icons for the user. If the user’s status is Invited, there is also an icon to resend the user’s invitation.
Invite Users
If you have Just-in-Time (JIT) provisioning enabled, you do not need to invite users manually.
1
In the Users tab, click Invite Users to open the user invitation dialog.
2
Enter the email address of the user that you want to invite. To send multiple invitations at the same time, add a space between each email address.
If you invite multiple users at the same time, they will have the same role(s). You can change their role(s) individually after sending the invitation.
3
Select the System Role for the new user(s).
4
(Optional) Select an Access Role for the new user(s).
5
(Query users only) Toggle on Support Access Privileges if you want the user(s) to be able to authorize support access to their account. Administrators can revoke support access at any time.
6
(Optional) Select Permissions for the new user(s). Select the allowed permissions for each entity (data connection or workspace) in the system. Administrators and Connection Administrators can edit permissions later.For more information about permissions, see Permissions and Access Control.
7
Click Send Invite. If a user is registered already to an email address that you enter, the dialog prompts you to enter a different email address.
Accept an Invitation
Follow these steps to set up access after receiving an invitation email:1
Click Accept Invite in the invitation email to open the password creation page.
2
Create a password that meets the provided criteria. After you create a password, the login page appears.
3
Log in with your email address and your new password. After you log in, the sign-up page appears.
4
Enter your first name and last name.
5
Enter the account name and the invite code from the invitation email. Then, click Complete Sign Up.
Connect AI supports Single Sign-On (SSO) through popular SSO providers. If SSO is enabled on your account, the invitation flow uses your SSO provider instead of the manual password process.
Manage Invitations
If a user has a pending invitation that they have not accepted, their status displays as Invited. Click a pending user to view and manage their invitation. On this page, you can view the pending user’s email address, the expiration time for the invitation, and the invite code. You can also manage the user’s invitation, as follows:- To revoke the invitation and delete the user, click Delete User.
- To resend the invitation email to the entered email address, click Resend Invite.
Edit Users
Click a user in the list (or click the Edit button) to open the Edit User page.
- Editable First Name and Last Name fields.
- A non-editable Email field.
- A drop-down menu to select the user’s System Role.
- A drop-down menu to select an additional Access Role (optional). These are any access roles that were created.
- A toggle for enabling or disabling Support Access Privileges (query users only). If enabled, the query user can grant account access to the CData support team.
- Check boxes for toggling the user’s permissions for each data source. (Note that CData Connect Spreadsheets users do not have a permissions section, because they have full permissions.)
Delete Users
To delete the user, click Delete User.If the user is the last remaining Administrator on your account, they cannot be deleted.
Service Accounts
The Service Accounts tab contains information about every service account in Connect AI. Service accounts authenticate via OAuth 2.0 Client Credentials. Use them to grant programmatic access to scripts, jobs, and external services.
- A row for every service account in your account:
- Name is the service account name.
- Client Id is the unique identifier used to authenticate the service account via OAuth 2.0 Client Credentials.
- Status is the status of the service account (active or inactive). If you deactivate a service account, any services or automations using these credentials will fail on the next request. The service account remains in the registry for audit purposes.
- Created is the date and time the service account was created.
- Rotate, edit, and delete icons for the service account. When you rotate credentials, the current credentials stop working immediately. You must update dependent services before the next request.
Add a Service Account
1
In the Service Accounts tab, click Add Account to open the Add Service Account page.
2
Enter the Name of the service account.
3
Enter a short Description of the service account.
4
Select an Authentication Type of Client Secret or Public Key. If you select Public Key, you are asked to upload the public key (PEM) file (RS256 or ES256).
5
Click Confirm to save the service account.
6
If you selected Client Secret, an Add Service Account dialog appears. Copy the Client Id and Client Secret. The Client Secret only appears once.
Use these credentials to authenticate API calls. See Authentication for details.
7
Click Done. An Edit Service Account page appears.
8
(Optional) Add an Access Role to the service account. Selecting an access role automatically updates the Permissions to the entities below.
9
(Optional) In Permissions, manually select the service account’s permissions to entities (data connections and workspaces) in your Connect AI instance. For more information about permissions, see Permissions and Access Control.
Edit a Service Account
You can modify any service account, rotate credentials, or delete a service account at any time by clicking the rotate, edit, or delete icons in the Service Accounts list. In the Edit Service Account page, you can do the following:- Edit the Name and Description fields.
- Add and remove access roles.
- Manually update permissions.
- Rotate credentials (the current credentials will stop working immediately).
- Delete the entire service account.
Roles
The Roles tab contains information about every role in Connect AI. Roles consist of predefined system roles and access roles.- A system role (Administrator, Connection Administrator, User Administrator, or Query) defines what a user can do across the platform (managing connections, users, and running queries), and every user has exactly one.
- An access role is an optional, admin-defined set of data and workspace permissions assigned on top of the system role; access roles are additive, so a user can hold several.
- A row for every role in your account:
- Role is the role name.
- Privileges & Permissions is a short overview of the scope of the role.
- Edit and delete icons for the role. System roles cannot be deleted.
Add an Access Role
1
In the Roles tab, click Add Role to open the Add Role page.
2
Enter the Role Name.
3
Enter a short description of the role that will appear on the Roles list.
4
In the Entities tab, select the appropriate permissions for entities (data connections and workspaces) in your Connect AI instance. For more information about permissions, see Permissions and Access Control.
5
In the Users tab, click Assign Users to assign multiple users to the same access role.
You can also add permissions to a user on an individual basis. These permissions are added to the role-based permissions.
6
Select one or more users to assign to the role, and click Confirm.
7
Click Save Changes to save the role.
Edit a Role
You can modify any role or delete an access role at any time by clicking the edit or delete icons in the Roles list.
- Edit the Role Name and Description fields (access roles only).
- Edit the permissions for the role.
- Assign or delete the users assigned to the role.
- Delete the entire role (access roles only).