Create and manage custom global roles - Dataphin - Alibaba Cloud - Dataphin

Prerequisites

Certain built-in global roles require you to purchase and activate the corresponding modules. These roles include Quality Administrator (requires Asset Quality or Tag Factory), Data Standard Administrator (requires Data Standard), Cross-tenant Publisher (requires Cross-tenant Publishing), and Tag Specialist (requires Tag Factory).

Background

Global roles are divided into system roles and custom roles.

System roles: Predefined, built-in roles with specific permissions for basic access control. You cannot create new system roles, but you can assign them to users or use them as templates for custom roles. The following system roles are available in Dataphin.

Role name	Description	Can be disabled	Can be edited
Super Administrator	Has operational and management permissions for all modules except Cross-tenant Publishing.	No	No
General Administrator	Has view-only permissions for most non-sensitive modules.	No	Yes
System Administrator	Manages data domains, projects, compute sources, and configurations in the Management Center. Has the highest permissions for the Planning module and the Management Center, excluding data source management.	Yes	Yes
Operations Administrator	Manages the asset catalog, including creating, editing, and deleting asset topics and modifying catalog configurations.	Yes	Yes
Security Administrator	Has the highest permissions for the security module, including managing project security policies, data identification and masking rules, algorithms, and keys.	Yes	Yes
Quality Administrator	Has the highest permissions for the quality module, including creating quality rules for resources such as data tables and data sources, and viewing data quality reports.	Yes	Yes
Data Source Administrator	Manages all data sources, including creating, editing, and deleting data sources and setting their rate limits.	Yes	Yes
Data Standard Administrator	Has the highest permissions for the standard module, including managing all standard sets, mapping rules, and reference data.	Yes	Yes
Cross-tenant Publisher	Has operational permissions for cross-tenant data publishing, including exporting and importing publishing packages.	Yes	Yes
Tag Specialist	Has usage permissions only for the Asset Marketplace and Asset Applications in the Tags module.	Yes	Yes

For more information about the permissions of global roles, see Appendix: Global and project role permissions.

Note

When you edit a system role, you cannot modify the role name.

Custom roles: The Super Administrator and System Administrator can create custom roles to grant granular permissions based on user responsibilities, ensuring users access only the resources they need. The following sections describe how to create and manage these roles.

Permissions

A Super Administrator or System Administrator can create, edit, clone, enable, disable, and delete global roles.
A General Administrator can only view role details.

Create a custom global role

In the top navigation bar of the Dataphin homepage, choose Management Center > Member Management.
In the left-side navigation pane, choose Account Management > Global Role Management. On the Global Role Management page, click + Create Custom Global Role.

On the Create Custom Role page, configure the following parameters.

Parameter		Description
Basic information	role name	Name the role based on your business scenario. The name can be up to 64 characters long and must be unique among global roles.
	role description	Describe the role's purpose and use case for easier management. The description can be up to 512 characters long.
Menu and function permissions		Configure permissions for the role. The menu functions are listed in the same order as the menu settings. Click Menu Settings to go to Style Settings > Menu Settings to configure the menu. You can also click Reuse Role Permissions to apply another role's permissions as a template and then modify them. For more information about role permissions, see Global role permissions. Important If a role lacks view permission for a function, users with that role cannot see or access it in the menu bar after logging in to Dataphin.

Click OK to create the custom global role.

If you click Cancel, the page closes without saving your changes.

View and manage custom global roles

In the top navigation bar of the Dataphin homepage, choose Management Center > Member Management.
In the left-side navigation pane, choose Account Management > Global Role Management.
On the Global Role Management page, view role names, descriptions, and other details in the global roles list.
- global roles: Include system roles and custom roles.
  - system roles: Include Super Administrator, System Administrator, Operations Administrator, Security Administrator, Quality Administrator, Data Source Administrator, Data Standard Administrator, Cross-tenant Publisher, General Administrator, and Tag Specialist.
  - custom roles: Roles created based on business scenarios.
- Role description: Describes the permissions granted by the global role.

In the global roles list, you can view, clone, edit, and delete roles.

The following table describes the operations you can perform.

Note

system roles support the following actions: View role details, Enable, Disable, and Clone as a custom role.
custom roles support the following actions: View role details, Clone as a custom role, Edit, and Delete.

Actions	Description
Enable	You can enable a global role that has been disabled. Click the switch in the Enabled column for the target role. Once enabled, the role can be used and assigned.
Disable	You can disable a global role that is currently enabled. Click the switch in the Enabled column for the target global role. In the dialog box that appears, click OK. After the role is disabled, it cannot be used or assigned, and this affects built-in approval processes. Note You cannot disable the Super Administrator and General Administrator roles. If the role is not assigned to any members, you can disable it directly. If the role is assigned, you must first reassign the affected members to a new role.
View role details	Click the icon in the Actions column of a role to view its Basic information and In-project permissions on the role details page. For a custom role, you can click Edit Configuration on the role details page to modify its Basic information, Reuse role permissions, and Menu and function permissions.
Clone as a custom role	Clone a global role to quickly create a new custom role with modifiable settings. You can clone both system roles and custom roles. In the Actions column for the target global role, click the icon. On the Clone Custom Role/Clone System Role page, modify the role's Basic information, Reuse role permissions, and Menu and function permissions. When finished, click OK.
Edit	To edit a custom role, click the icon in its Actions column. You can then modify its basic information, reuse role permissions, and menu and function permissions. Click OK to save the changes.
Delete	Delete redundant or unused custom roles. In the Actions column for the custom role, click the icon and select Delete. In the dialog box that appears, click OK. Note If the role is assigned to a member, you must first reassign the member to a new role. The member will lose the approval permissions associated with the original role.

Single tenant with multiple engines

In a multi-engine tenant, when you create a global role, Dataphin displays only the features selected during tenant creation.