Metadata access control restricts database visibility at the user, database, or instance level — users without permissions cannot see or search for those objects in DMS.
Prerequisites
The control mode of the target instance must be Security Collaboration. For more information, see Control modes.
Your system role is administrator. For more information, see System roles.
Background information
As a unified database management portal, DMS provides access control for different users to access different data. The metadata access control feature further strengthens data security. After this feature is enabled, you can restrict specified users to view and access only databases for which they are authorized, and ensure that specified databases can only be viewed and accessed by authorized users.
In DMS, database-level permissions include Query, Export, and Change. A user who holds any of these permissions is considered authorized for the database and can perform the following operations in DMS:
View the database in the left-side navigation pane, top search bar, and permission request search bar. Whether the user can query data in the database depends on whether the user has Query permissions.
View the instance information of the database. However, the user cannot see other databases in the same instance. Whether the user can view other databases depends on whether the user has permissions on those databases.
Metadata access control is disabled by default. When disabled, users can view all databases under an instance in the left-side navigation pane, top search bar, and permission request search bar in the DMS console. However, visibility does not grant operational permissions. Actual operational access is determined by the permissions granted by the administrator.
You can control metadata access permissions in the following three ways:
User access control: Restricts the specified user to view and access only databases for which they are authorized.
Database access control: Restricts the specified database to be viewed and accessed only by authorized users.
Instance access control: Restricts the specified instance and all its databases to be viewed and accessed only by authorized users.
Usage notes
Metadata access control supports only instance-level and database-level granularity. It does not support access control for tables or programmable objects such as stored procedures and functions. The granularity of each control type is as follows:
User access control: Controls which instances and databases a specific user can view and access. Granularity: instance level and database level.
Database access control: Controls which users can view and access a specific database. Granularity: database level.
Instance access control: Controls which users can view and access a specific instance and all its databases. Granularity: instance level.
System roles such as administrator, DBA, and instance owner are exempt from metadata access control. Even after metadata access control is enabled, these roles can still view and access all instances and databases. Metadata access control restrictions apply only to regular users for whom access control is enabled.
For a database or instance with metadata access control enabled, users without metadata permission cannot request permission by submitting a ticket. Only an administrator or DBA can grant these permissions.
Enable access control for a user
After you enable metadata access control for a user, that user:
Can see only the databases on which they have permissions. To check which databases a user has permissions on, go to Security and specifications > Permission center > Permissions. For details, see View your permissions.
Cannot view or apply for permissions on any database instance or database they lack permissions on.
Log on to the DMS 5.0 console.
In the top navigation bar, choose O&M > Users.
Find the user, click click More > Access control in the Actions column.
NoteTo enable access control for multiple users at once, select the users and click Access control at the top of the page.
In the User access control dialog box, turn on Metadata access control and click OK.
Enable metadata access control for a database
Log on to the DMS 5.0 console.
Move the pointer over the
icon in the upper-left corner of the DMS console and choose . NoteIf you use the DMS console in normal mode, choose in the top navigation bar.
On the Instances page, click the Database List tab.
Find the database, choose in the Actions column.
NoteTo enable metadata access control for multiple databases at once, select the databases, choose at the top of the tab.
In the Metadata access control dialog box, turn on Metadata access control and click OK.
Enable metadata access control for a database instance
Log on to the DMS 5.0 console.
Move the pointer over the
icon in the upper-left corner of the DMS console and choose . NoteIf you use the DMS console in normal mode, choose in the top navigation bar.
On the Instances page, click the Instance List tab.
Find the instance, choose in the Actions column.
NoteMetadata access control is available only for instances in Security Collaboration mode. You can also enable metadata access control for multiple instances at a time.
In the Metadata access control dialog box, turn on Metadata access control and click OK.