Enable or disable metadata access control
In Data Management (DMS), metadata access control manages user permissions to view and access databases and instances. When enabled, users who do not have query, export, or change permissions for a database or instance cannot view or access that resource. This topic describes how to enable instance-level and database-level metadata access control in DMS.
Prerequisites
The control mode of the target instance is set to Security Collaboration. Only instances in security collaboration mode support metadata access control. Instances in free operation or stable change mode do not support this feature. For more information, see Control modes.
Your system role is DBA or administrator. For more information, see View system role.
Usage notes
Metadata access control is disabled by default. When disabled, users can view all databases under an instance in the left-side navigation pane, top search bar, and permission request search bar in the DMS console. However, visibility does not grant operational permissions. Users still require specific query, export, or change permissions that must be granted by an administrator.
Metadata access control supports only instance-level and database-level granularity. It does not support access control for tables or programmable objects such as stored procedures and functions. The granularity of each control type is as follows:
User access control: Controls which instances and databases a specific user can view and access. Granularity: instance level and database level.
Database access control: Controls which users can view and access a specific database. Granularity: database level.
Instance access control: Controls which users can view and access a specific instance and all its databases. Granularity: instance level.
System roles such as administrator, DBA, and instance owner are exempt from metadata access control. Even after metadata access control is enabled, these roles can still view and access all instances and databases. Metadata access control restrictions apply only to regular users for whom access control is enabled.
For a database or instance with metadata access control enabled, users without metadata permission cannot request permission by submitting a ticket. Only a DBA or an administrator can grant these permissions.
Procedure
Log on to the DMS 5.0 console.
Move the pointer over the
icon in the upper-left corner of the DMS console and choose . NoteIf you use the DMS console in normal mode, choose in the top navigation bar.
Enable or disable metadata access control.
Instance-level access control
On the Instance List tab, find the target instance.
In the Actions column of the target instance, choose .
Turn the Metadata access control switch on or off, and then click OK.
Database-level access control
On the Database List tab, find the target database.
In the Actions column of the target database, choose .
Turn the Metadata access control switch on or off, and then click OK.
Related operations
To grant a user permission at the instance or database level, an administrator or a DBA can go to the Instance List tab and choose . For more information, see Manage resource permissions by using the instance management feature.
Configure user access control
An administrator can enable user access control to limit a user's visibility to only the instances and databases for which they have permission. Once enabled, the user cannot see resources they do not have permission to access, nor can they request permission for them. For more information, see User management.