Database privileges

You can assign database privileges with a predefined database role. Each role is associated with a set of privileges that determines what a user can access on a database that the MC manages.

You grant database privileges on MC Settings > User Management when you add or edit a user account. You can also map an MC user to a Vertica server database user, which allows the MC user to inherit database privileges from the server user.

The following table provides a brief overview of each role:

Admin

Admin is the most permissive role. It is a superuser with full privileges to monitor activity and messages on databases that the MC manages. Other database privileges (such as stop or drop the database) are inherited from its mapped server user account.

There is also an Admin configuration role that grants configuration privileges for the MC. The two Admin roles are not the same. The Admin MC configuration role can manage all MC users and all databases imported into the UI, but the MC database Admin role has privileges only on the databases you map this user to.

Associate

The Associate role has the same monitoring privileges as an Admin user—full privileges to monitor MC-managed database activity and messages. Unlike the Admin user, the Associate cannot start, stop, or drop a database. The Associate user inherits database privileges its mapped server user account, including the following:

• Install or audit a license
• Manage database settings
• View Database Designer
• View the database Activity page

IT

The IT role can view most details about a database that the MC manages, including the following:

• Messages (and mark them read/unread)
• Overal database health, activity, and resources
• Cluster and node state
• MC settings

There is also an IT role at the MC configuration access level. The two IT roles are not the same. For additional details, see Configuration roles in MC.

User

The User role has limited database privileges, such as viewing database cluster health, activity, resources, and messages. MC users with the User database role might have higher MC privileges, granted with configuration roles.

Role comparison

The following table summarizes default MC database privileges by role:

Granting database privileges

You can grant database privileges to new and existing users on MC Settings > User Management.

Prerequisites

• Determine the database privileges that you want to grant the new MC user.
• Optional: Create or import a database to associate with the new user.
• Optional: Create a database user account if you want to map a server database user to an MC user account.

Mapping to server users

When you assign MC database privileges, map the MC user account to a Vertica server database user account for the following benefits:

• The MC user inherits database privileges from the database user, so you need to maintain privileges for one user.
• Restrict the MC user from accessing functionality not permitted by the Vertica server database user account privileges.

If there is a conflict between server and MC database privileges, server privileges supersede MC privileges. When the MC user logs in, Vertica compares the MC user database privileges to the privileges assigned to its mapped server user account. Vertica permits the user to perform an operation in MC only when the MC user has both MC and server database privileges for that operation.

Grant a database role

When you grant an MC user a database role, that user inherits the privileges assigned to its mapped server user account.

1. Log in to Management Console as an administrator, and go to MC Settings > User management.

2. In the grid, select an MC user and select Edit.

3. Verify that MC configuration permissions lists the correct configuration role. None is the default setting.

4. In DB access levels, select Add and provide the following information:

   1. Choose a database. Select a database from the list databases that you imported or created with the MC.

   2. Database username. Enter an existing database username or select the ellipsis [...] button to browse running databases for a list of database users.

   3. Database password. Enter the password to the server database user account.

   4. Restricted access. Choose a database level. For details, see Admin, IT, or User.

   5. Select OK.

   6. If the Vertica database requires TLS, select Yes in the Use TLS Connection, then select Configure TLS for user. MC launches the Certificates wizard to let you configure TLS. For details, see MC certificates wizard.

      Note

      If TLS/SSL is configured in mutual mode on the Vertica database, each MC user must be configured with an individual client certificate and private key, to log into the database from MC. See Configuring mutual TLS for MC users. If the individual certificate has not been configured, you see an error message. contact your Management Console administrator.

5. Select Save.