Skip to content

Group <> User role sync

The Group <> User role sync package assigns role to users based on the Atlan group they belong to.

Configuration

Credential

  • API Token: Atlan API token to render the role and group widget response in the Admin section.

Configuration

  • Selection mode: whether to match the groups by name or regex match.
    • List: if the name (display name) of the group is used to fill Admin Group, Member Group and Guest Group.
    • Regex: if a regex is used to fill Admin Group, Member Group and Guest Group. All groups that match the regex expression will be used.
  • Role hierarchy: Hierarchy of the roles. If a user belongs to more than one group and each group has a different role mapped, the hierarchy will defined the final role of the user. The available options are:
    • Guest -> Member -> Admin (Default): the Guest role has precedence over the Member role that has precedence over the Admin role,
    • Guest -> Admin -> Member: the Guest role has precedence over the Admin role that has precedence over the Member role
    • Member -> Guest -> Admin: the Member role has precedence over the Guest role that has precedence over the Admin role
    • Member -> Admin -> Guest: the Member role has precedence over the Admin role that has precedence over the Guest role
    • Admin -> Guest -> Member: the Admin role has precedence over the Guest role that has precedence over the Member role
    • Admin -> Member -> Guest: the Admin role has precedence over the Member role that has precedence over the Guest role

Note

Sub-Roles have the same precedence as their parent role. Internal hierarchy for sub-roles within their parent section is controlled by the order of the sub-role selection in case of dynamic option, with the first selected sub-role having the highest precedence. In case of static option, the sub-role hierarchy input field will be used to define the hierarchy.

Admin

  • Admin Group: Name (display name) or regex matching expression of the Atlan groups (comma separated) that contain users with admin role. The package updates the role of the users belonging to these groups to admin.

  • Admin sub-role option: Select the type of admin sub-role assigment logic to be followed by the workflow.

    • Workflow Admin (sub role) Group: Name (display name) or regex matching expression of the Atlan groups (comma separated) that contain users with workflow-admin sub-role. The package updates the role of the users belonging to these groups to workflow-admin.

    • Governance Admin (sub role) Group: Name (display name) or regex matching expression of the Atlan groups (comma separated) that contain users with governance-admin sub-role. The package updates the role of the users belonging to these groups to governance-admin.

    • Admin Sub Role hierarchy: Hierarchy of the sub-roles. If a user belongs to more than one group and each group has a different role mapped, the hierarchy will defined the final role of the user. Give sub-role names as comma separated plain text with the correct name format for the supported sub-roles :

      • workflow-admin : To manage workflows and connections
      • governance-admin: To manage governance center
    • Admin sub-role: Select the role which have a sub-admin level privilege and the groups that contain the users who are to be assigned the sub-admin role. Perform the selection for each sub-role in the order of the role hierarchy to be followed by the workflow. Only five admin sub-role are allowed to be selected.

Member

  • Member Group: Name (display name) or regex matching expression of the Atlan groups (comma separated) that contain users with member role. The script updates the role of the users belonging to these groups to member.

Guest

  • Guest Group: Name (display name) or regex matching expression of the Atlan groups (comma separated) that contain users with guest role. The script updates the role of the users belonging to these groups to guest.

What it does

  1. Fetch all users that belongs to the groups specified in Admin Group, Member Group and Guest Group.
  2. Assign a role to users based on the group they belong to:
    • admin role to all users belonging to Admin Group
    • member role to all users belonging to Member Group
    • guest role to all users belonging to Guest Group

If a user is assigned to more than one of the specified group, the role with higher precedence in the selected role hierarchy is assigned. Example: if a user belongs to both the Admin Group and the Guest Group, the guest role is assigned when either Guest -> Member -> Admin or Guest -> Admin -> Member is selected as the role hierarchy.