Role-based Access Control

info

Requires DBmarlin 4.8.0 or above.

About RBAC

Role-based Access Control commonly known as RBAC let you control what level of access a user has within DBmarlin.

There are three types of users:

• Admin users - can see all databases and do all operations within DBmarlin
• Instance administrators - regular users who can also manage the instances they have access to, such as changing collection settings and starting or stopping monitoring. See Instance administrators for details. New in DBmarlin 6.10.0.
• Regular non-admin users - by default will have no access to databases and must be granted access via an Admin user. Regular users cannot carry out user administration (although they can view a list of all users).

Pre-requistites

RABC requires that Authentication is enabled.

Granting access to Regular non-admin user

Granting access can only be done by an admin user. You should always have at least one admin user. If needed you can create an admin user or grant admin access to an existing user by running the dbmarlin-add-user script on the DBmarlin server.

Once logged in as a DBmarlin admin user you can see the Settings -> Logins which allows you to grant access to other users.

Tag-based access control

Access control is tag-based meaning that the admin user needs to tag the instances and then grant a user access to all instances which match a tag filter pattern. You may use existing tags or create new tags specifically for access control.

Here are some worked examples:

1. If you tagged your instances by Env with tag values of Test/Prod/Staging
   1. You could grant a user access to tags Env=Test which would allow access to only those instances matching Env=Test.
   2. Or, you could grant a user access to see instances matching Env=Test, Env=Staging which would allow access to those instances matching Env=Test OR Env=Staging.
2. If you tagged your instances by App with tag values of Website/Finance/Cognos
   1. App=Website which would allow access to only those instances matching App=Website.
   2. Or, you could grant a user access to see instances matching App=Website, App=Finance which would allow access to those instances matching App=Website OR App=Finance
3. If instances had both Env and App tags then you can combine the tags.
   Combining tags

   Note that when combining tag filters, within a Tag names the logic is to OR them but across different Tag names the logic is to AND them together.

   1. You could grant a user access to tags Env=Test, App=Website which would only match instances which have both of these tags set App=Website AND App=Finance
   2. Or you could grant access to see Env=Test, Env=Staging, App=Finance which would only match instances which have either (Env=Test AND App=Finance) OR (Env=Staging AND App=Finance)

Instance administrators

info

New in DBmarlin 6.10.0.

An admin user can give a regular non-admin login the Instance administrator role. An instance administrator can look after the instances they have access to without being a full admin user. For example, a DBA team lead could manage the production SQL Server instances while another team manages the Oracle instances.

Instance administrators can only manage the instances that match the tags assigned to them. They have the same read-only access as a regular user to everything else.

Making a login an instance administrator

1. Log in as an admin user and go to Settings -> Logins.
2. Edit the login and tick Instance administrator.
3. Assign the tags that select the instances the user should manage.
4. Save the login.

The Instance administrator option is not available for admin users, because they already have full access. The Type column in the list of logins shows Administrator or Instance administrator for each login.

What each type of user can do

Action	Regular user	Instance administrator	Admin user
View instances, SQL, waits and other performance data	Matching tags	Matching tags	All
Start and stop monitoring, including bulk start and stop from the instance list	❌	Matching tags	All
Edit instance settings such as connection details, collection options and explain limit	❌	Matching tags	All
Link hosts to an instance	❌	Matching tags	All
Add custom events to an instance	❌	Matching tags	All
Save snapshots	❌	Matching tags, up to one day long	All, any length
Edit and delete snapshots	❌	Matching tags	All
Change an instance's tags or third-party links	❌	❌	✅
Create or delete instances	❌	❌	✅
Create, edit or start and stop hosts	❌	❌	✅
Create or edit event types, and update SQL and database statistics settings	❌	❌	✅
Manage logins and access control	❌	❌	✅

note

Instance administrators cannot change an instance's tags. Tags decide which instances a user can access, so only admin users can change them. This stops an instance administrator from giving themselves access to more instances.