MDS Versioning, Permission and Security - Page 2
October 20, 2010
Permission and Security in MDS...
Master Data Services has two different types of administrators, Master Data Services' system administrator and model administrator. System administrator can be only one and is specified when creating MDS database (though it can be changed later on if required). This account has access (Update permission) to all the models (including metadata model) irrespective of who created them. The system administrator can also perform all of the administrative tasks in all the functional areas. On the other hand, model administrator has access (Update permission) on the model and no other permissions assigned. If the model administrator has access to Explorer functional area he/she can access all master data of the model or if he/she has access to other functional areas (Version Management, Integration Management, System Administration, User and Group Permissions) the user can perform other administrative tasks accordingly.
There are five different functional areas in MDS and depending on the access on these functional areas, the user will be able to see it in Master Data Manager UI. You also need to have access on one or more models:
There are basically three types of permissions in MDS i.e. Read-only, Update and Deny. A user with Read-only permission on the model will be able to see the model but will not be able to make any changes to it and its objects whereas a user with Update permission on model will be able to see the model as well as make changes to it. If a user is denied permission, the user will not be able to see the model. The permission on the model applies to all versions of the model; there is no way to assign permission on a specific version. A user inherits the permission on an object from its parent in the tree structure unless you specifically change it at child level.
Go to Master Data Manager UI, click on the User and Group Permissions option as shown below:
Here you can manage the permissions of user and group which could belong to either the local system or an active directory of the domain. Its recommended you make a group of users and give permissions to the group instead of giving permissions to each individual. Click on Manage Group menu and the click on the + sign (Add groups) as shown below:
Enter the name of the group and click on Check names to validate the existence of the group, click on OK to save and return to the previous menu.
Click on the icon in the first column of the grid and select Edit -> Functions to give access to the functional areas to the group.
You can select the functional areas from the left side list box and assign to the group as shown below:
On the next screen you will be selecting the models on which this group will have access. You can see here, I have denied access on ChartOfAccounts model, Read-only access on Metadata and Update permission on Product model. Please note, you need to select at least one model to make functional areas visible to the users of the group.
Master Data Services (MDS) is a master data management platform that allows you to create a centralized hub (model) for your master data that behaves like a single authoritative source for your master data. In this article, I discussed how versioning works for model data, and what permissions and security considerations are required while working with MDS.