This topic describes how to manage users in Data Management (DMS). You can add users, modify users, and manage user permissions.
Prerequisites
You are a DMS administrator. For more information about how to view the role of a user, see View system roles.
Usage notes
Make sure that a tenant has at least one valid administrator account.
You can assign the administrator role to all users in DMS, including Alibaba Cloud accounts and Resource Access Management (RAM) users.
After you use your Alibaba Cloud account to activate DMS, the account is automatically assigned the DMS administrator role.
If a RAM user has the AdministratorAccess permission to manage all resources of your Alibaba Cloud account and is used to log on to DMS for the first time, the RAM user is also automatically assigned the DMS administrator role. For more information, see the Manage the configurations of RAM users section of the "Accounts used to log on to DMS" topic.
You can add multiple Alibaba Cloud accounts to a tenant. You can add users on the Users page. By default, the added users belong to the same tenant as your account. Users added to the tenant can view information about the current tenant. For more information, see the View information about the current tenant section of the "Manage DMS tenants" topic.
NoteIf you log on to DMS for the first time by using an Alibaba Cloud account, the system automatically creates a tenant for the account. For more information about tenants, see the Background information section of the "Manage DMS tenants" topic.
Log on to the DMS console
You can log on to the DMS console in one of the following ways:
Log on to the DMS console by using an Alibaba Cloud account. For more information, see Accounts used to log on to DMS.
Log on to the DMS console as a RAM user. For more information, see Accounts used to log on to DMS.
Implement user-based single sign-on (SSO) or role-based SSO to log on to the DMS console by using the identity provider (IdP) of your enterprise. SSO is also known as identity federation. For more information, see Use SSO to log on to DMS.
Add a user
Method 1: Manually add a user
- Log on to the DMS console V5.0.
In the top navigation bar, click O&M. In the left-side navigation pane, click Users.
NoteIf you use the DMS console in simple mode, move the pointer over the
icon in the upper-left corner of the DMS console and choose All functions > O&M > Users. On the Users page, click New.
In the Add User dialog box, enter the Alibaba Cloud account ID of the user that you want to add.
NoteMove the pointer over the
icon in the upper-right corner of the console and view your Alibaba Cloud account ID. Select one or more system roles for the user that you want to add. For more information, see System roles.
Click OK.
Method 2: Add a RAM user that belongs to the current Alibaba Cloud account
Only the current Alibaba Cloud account or a RAM user that has the ListUser permission can add a RAM user by using this method.
By default, RAM users that are added to DMS in this way are assigned the regular user role. You can change the roles of users based on your business requirements. For more information, see the Modify a user section of this topic.
- Log on to the DMS console V5.0.
In the top navigation bar, click O&M. In the left-side navigation pane, click Users.
NoteIf you use the DMS console in simple mode, move the pointer over the
icon in the upper-left corner of the DMS console and choose All functions > O&M > Users. In the upper part of the Users page, click Synchronize RAM User.
In the Synchronize RAM User dialog box, search for an account by display name or Alibaba Cloud account ID.
Select one or more RAM users and click Add Selected Users.
Modify a user
Modify the information about a user
- Log on to the DMS console V5.0.
In the top navigation bar, click O&M. In the left-side navigation pane, click Users.
NoteIf you use the DMS console in simple mode, move the pointer over the
icon in the upper-left corner of the DMS console and choose All functions > O&M > Users. On the Users page, select the user whose information you want to modify.
Click Edit User in the upper part of the page.
NoteYou can also click Change in the Actions column to modify the user information.
In the Edit User dialog box, modify the following information.
NoteYou can change your mobile phone number and email address at the tenant profile picture. For more information, see Configure personal information and notification methods.
Section
Parameter
Description
Basic info
Display Name
The display name on the Users page. The display name demonstrates the identity of the user.
Role
The role of the user. DMS provides five system roles: regular user, database administrator (DBA), administrator, security administrator, and schema read-only user. For more information, see System roles.
The maximum number of queries
The maximum number of queries that can be performed by the user within a specific period of time. The value of the parameter must be an integer. You can select a time period from the right-side drop-down list, or select Others in the drop-down list and specify a custom time period.
NoteTo query data after a system is published or track the status of a system, a user may query more rows than the upper limit for a day, or query data more times than the upper limit for a day. In this case, you can set the upper limits to greater values for the user as required.
Query the upper limit number of rows
The maximum number of rows that can be queried by the user within a specific period of time. The value of the parameter must be an integer. You can select a time period from the right-side drop-down list, or select Others in the drop-down list and specify a custom time period.
DingTalk Chatbot
The webhook URL of the DingTalk chatbot. For more information, see Obtain the webhook URL of a DingTalk chatbot.
webhook
The custom webhook URL that DMS uses to send notifications. You can integrate the webhook URL to your O&M system or message notification system. For more information, see Send notifications by using a custom webhook URL.
Signature Method
The signature method. Valid values:
NONE: No algorithm is used. This is the default value.
HMAC_SHA1: The Hashed Message Authentication Code Secure Hash Algorithm 1 (HMAC_SHA1) is used.
Signature Key
The key that is used. This parameter is displayed only if you set the Signature Method parameter to HMAC_SHA1.
Notification method
The notification method. You can select one or more options among SMS, DingTalk, Email, DingTalk Chatbot, and webhook.
Click Confirm Change.
Grant permissions to users
The following example shows how to grant permissions on instances to users. You can also grant users permissions on permission templates, databases, tables, rows, and sensitive columns. For more information about permissions, see Overview.
- Log on to the DMS console V5.0.
In the top navigation bar, click O&M. In the left-side navigation pane, click Users.
NoteIf you use the DMS console in simple mode, move the pointer over the
icon in the upper-left corner of the DMS console and choose All functions > O&M > Users. On the Users page, select the user to whom you want to grant permissions and select Authorize instance from the Authorize User drop-down list in the upper part of the page.
NoteYou can also choose in the Actions column to grant permissions to the user.
In the Authorize Instance dialog box, configure the parameters that are described in the following table.
Section
Parameter
Required
Description
Authorized instance
N/A
Yes
Select one or more database instances on which permissions you want to grant to the user.
Permission Configuration
Permission
Yes
The type of permission to be granted to the user. For database instances that are not managed in Security Collaboration mode, set this parameter to Instances-Login. For database instances that are managed in Security Collaboration mode, set this parameter to Performance view.
Expire Date
Yes
The date on which the permission expires.
Disable a user
After you disable a user, the permissions and configuration data of the user are not revoked or released. However, the user cannot log on to DMS. After the user is enabled, the permissions and configuration data automatically become valid again.
The disabled user still counts towards the maximum number of users allowed in your tenant account.
If you need to disable a user who manages a database instance as a DBA, you must first assign the DBA role to another user. For more information about how to change the DBA of a database instance, see Modify database instances.
- Log on to the DMS console V5.0.
In the top navigation bar, click O&M. In the left-side navigation pane, click Users.
NoteIf you use the DMS console in simple mode, move the pointer over the
icon in the upper-left corner of the DMS console and choose All functions > O&M > Users. On the Users page, select the user that you want to disable and select Disable User from the User drop-down list in the upper part of the page.
In the message that appears, click OK.
Remove a user
After you remove a user, the user cannot log on to DMS. All data owner configurations and permissions are cleared from DMS.
Before you remove a user, make sure that the user is not associated with data resources. For example, you cannot remove a user who manages a database instance as a DBA or an approver that is specified in security rules.
After you remove a user, all data of the user is cleared. However, the user information and relevant operation logs are retained and marked as Deleted in account information.
The removed user no longer counts towards the maximum number of users allowed in your tenant account.
- Log on to the DMS console V5.0.
In the top navigation bar, click O&M. In the left-side navigation pane, click Users.
NoteIf you use the DMS console in simple mode, move the pointer over the
icon in the upper-left corner of the DMS console and choose All functions > O&M > Users. On the Users page,select the user that you want to remove and choose Delete User from the User drop-down list in the upper part of the page.
In the message that appears, click OK.
Enable a user
After you enable a disabled user, the permissions and configuration data of the user become valid, and the user can log on to DMS. However, after you enable a removed user, all permissions and configurations of the user are still invalid. In this case, you must configure the user and grant permissions to the user again. For more information, see Permission application.
- Log on to the DMS console V5.0.
In the top navigation bar, click O&M. In the left-side navigation pane, click Users.
NoteIf you use the DMS console in simple mode, move the pointer over the
icon in the upper-left corner of the DMS console and choose All functions > O&M > Users. On the Users page, select the user that you want to enable and select Enable User from the User drop-down list in the upper part of the page.
In the message that appears, click OK.
Enable access control for a user
After you enable metadata access control for a user, the following limits apply to the user:
The user can only view information about and access the databases on which the user has permissions in DMS. In the top navigation bar of the console, choose to view the databases on which the user has permissions. For more information, see View owned permissions.
The user cannot view the database instances or databases on which the user has no permissions, or apply for permissions on these database instances or databases.
- Log on to the DMS console V5.0.
In the top navigation bar, click O&M. In the left-side navigation pane, click Users.
NoteIf you use the DMS console in simple mode, move the pointer over the
icon in the upper-left corner of the DMS console and choose All functions > O&M > Users. On the Users page, find the user for whom you want to enable access control and choose in the Actions column.
NoteTo enable access control for multiple users at a time, select the users and click Access control in the upper part of the page.
In the User access control dialog box, turn on Metadata access control and click OK.
References
After you manage users, you can also perform the following operations:
Specify a user as an approver for the approval process of a ticket. For more information, see Customize approval processes.
Grant permissions on database instances to users or revoke permissions on database instances from users. For more information, see Manage permissions on instances.
You can also call the following API operations to manage users in DMS:
FAQ
Q: Can I assign the DMS administrator or DBA role to a RAM user?
A: Yes. The role assignment is independent of the account type.
Q: What do I do if suspicious operations on a database are detected?
A:
If you want to retain the permissions of the user, you can disable the user. This way, the user cannot log on to the DMS console. Then, use the operation audit feature of DMS to view the operations that were performed by the user. If the user did not violate rules, you can enable the user. All the permissions and configurations of the user become valid again.
If you do not want to retain the permissions of the user, you can remove the user. This way, the user cannot log on to the DMS console, and all permissions and data owner configurations of the user are cleared.
Q: How do I search for a user when I use a DMS administrator account?
A: In the top navigation bar of the console, choose . On the Users page, search for a user by email address, display name, or Alibaba Cloud account ID, and filter users by status.
Q: Can a disabled user log on to the DMS console?
No, a disabled user cannot log on to the DMS console.
Q: When I disable a user, the system prompts that the user is the DBA of an instance and cannot be disabled. What do I do?
A: You can change the DBA of the instance.
NoteOnly a user that is assigned the DBA role in DMS can be specified as the DBA of an instance. If the user that you want to specify as the DBA of an instance is not assigned the DBA role in DMS, you must assign the DBA role to the user on the Users page.
Q: Why is a user that I removed from DMS still displayed on the Users page?
A: The user that you removed from DMS is marked as Deleted but cannot be totally cleared.
Q: How do I release the existing permissions of a user on resources such as instances and databases?
A: Go to the Users page as an administrator or DBA. Find the user that you want to manage and choose in the Actions column. Then, in the User Permissions dialog box, select the permissions that you want to release and click Release Permission.