Permissions overview

Deephaven enables fine-grained access control to data, queries, and reports. This is accomplished through the individual authorization of users and groups, access control lists (ACLs), and account information.

Authentication vs. authorization

There are two aspects to access control in Deephaven:

AspectDescriptionManaged by
AuthenticationVerification of a user's identityInternal (passwords) or external (LDAP, SAML, keys)
AuthorizationVerification of what permissions the user hasAlways internal to Deephaven

Authentication

Authentication can be handled:

  • Internally: Storing a password validation hash in the ACL store
  • Externally: Integrating with an external identity provider:

If external authentication is in use, a new user must be configured both in the external system and in Deephaven before they can log in.

Authorization

Authorization is handled entirely within Deephaven. Data access rights and system privileges can be granted to individual users or groups.

Groups in Deephaven are internal to the product. External group memberships (e.g., from Active Directory) are not automatically used. When using group-based permissions, add users to appropriate Deephaven groups manually, or configure SAML group synchronization for automatic group membership.

What can be controlled

ResourceControl levelDocumentation
Table dataRow and column filteringTable ACLs
Persistent QueriesView, edit, start/stop accessPersistent Query ACLs
System featuresConsole access, query creationSpecial groups
ACL managementWho can edit permissionsiris-acleditors group

Common tasks

TaskDocumentation
Create a new userWeb ACL editor or CLI
Create an admin userAdmin user
Grant table accessTable ACLs
Share query resultsPersistent Query ACLs
Set up key-based loginAuthentication keys

Note

If you are using a Legacy worker, please refer to the Legacy ACLs documentation.

This section covers