Manage users, groups, and roles in Gluesync

Select the Settings gear icon in the upper-right corner of the Control Plane;

Select Users & access, then keep the Users tab open;

In Add account, enter a Username, for example rbac-viewer;

Open User role and select Viewer or Manager;

Optionally enter Name (optional), Surname (optional), and Email (optional);

Select Create user.

Select the copy icon to copy the password to the clipboard, or the download icon to save it as a file;

If an email address was entered and email is configured for Gluesync, you can also select Send via email to send the credentials to the user;

Pass the password to the user through a secure channel, then close the message.

Open the Control Plane sign-in page and sign in with the username and the temporary password;

When Gluesync asks you to create a new password, enter it in New password and again in Repeat new password. The password must contain at least 8 characters, 1 lowercase letter, 1 uppercase letter, 1 symbol, and 1 number;

Select Create password;

Sign in again with the new password.

In Settings → Users & access → Users, find the account in Accounts. Use the search box to filter by username, for example rbac-;

To change the role, open the role list on the user’s row (1) and select the new role. The change takes effect immediately;

To issue a new temporary password, select the reset icon (2) and confirm Reset. The user must change the password at the next sign-in;

To remove the account, select the delete icon (3) and confirm.

Sign in as a Super Admin to get a token:

curl -s -X POST https://<core-hub-host>/authentication/login \
  -H 'Content-Type: application/json' \
  -d '{"username":"admin","password":"<admin-password>"}'

Create the user, setting role to MONITOR or SUPER_ADMIN:

curl -s -X POST https://<core-hub-host>/users \
  -H "Authorization: Bearer <apiToken>" \
  -H 'Content-Type: application/json' \
  -d '{"username":"rbac-monitor","password":"<temporary-password>","role":"MONITOR","name":"Monica","surname":"Monitor","email":"rbac-monitor@example.com"}'

Give the temporary password to the user. As with accounts created in the UI, the user must set a new password at the first sign-in.

In Settings → Users & access, select the User groups tab;

In New user group, enter a Name, for example RBAC analysts;

Open Members (optional) and select the users to include, for example rbac-viewer and rbac-monitor;

Optionally enter a Description (optional);

Select Create user group.

In Current user groups, find the group;

Select Manage members, the middle icon on the group’s row;

In Members of RBAC analysts, add or remove users;

Select Save members.

Open Settings → Query data access;

Under Applies to, select User group;

In User group, select the group, for example RBAC analysts;

In Connection, select the connection to restrict, for example RBAC demo-source;

Under Connection mode, select Restricted (1);

Select Add rule, enter the Schema shop and the Table (optional, * for all) customers, and switch Allow on (2);

Select Save policy (3).

In the second browser, sign in as a member of the group, for example rbac-viewer;

Open Query Studio, select + to open a new session, and then open the SQL-capable Agent list and choose the source agent of RBAC demo;

Expand the shop schema in the schema tree;

Run SELECT count(*) FROM shop.orders.

Sign in as rbac-viewer and open RBAC demo. Compare it with the Manager screenshot that follows;

Open Settings and note which sections are listed;

Sign in as rbac-manager and open the same pipeline and the same Settings dialog.

Sign in as the Viewer with POST /authentication/login to get an apiToken;

Try to start an entity:

curl -s -X POST "https://<core-hub-host>/pipelines/<pipeline-id>/commands/sync/start?entity=<entity-id>" \
  -H "Authorization: Bearer <viewer-apiToken>"

Try to list users:

curl -s https://<core-hub-host>/users -H "Authorization: Bearer <viewer-apiToken>"