Permissions

Introduction

This manual is intended to guide the reader through the following operations:

• Description of the user creation and permission-granting process
• Creating and updating a new user
• Granting a user permissions to features

These actions are performed through the SETTINGS / ADMINISTRATION area of the platform.

Overview

General workflow

A user's permissions grant or revoke access to Orkestra's features.

These permissions can be granted at a highly aggregated level, or acted upon at the finest level of granularity — namely, at the Module level for Data Fabrik, and at the Tag level for Data Shop.

They can be summarized as follows:

Managing a User

Creating a User

Creating a user is done in two steps:

• Creation
  • Process with "SSO" authentication
  • Process with "LDAP" authentication
  • Process with internal authentication
• Granting permissions

Single Sign-On (SSO – SAML2)

Allows users to log in to the Orkestra platform using their corporate account, without having to manage a password specific to the platform.

Single sign-on (SSO) relies on the SAML2 protocol and integrates with the company's existing identity system (Active Directory, Azure AD, etc.).

General Principle

When a user accesses the Orkestra platform:

1. They are redirected to their company's identity provider (Identity Provider – IdP).
2. The IdP authenticates the user according to internal security rules (password policy, etc.).
3. The IdP returns a signed SAML assertion to Orkestra, confirming the user's identity.
4. Orkestra creates or updates the user's session according to the rights associated with their account.

The user is thus automatically logged in to Orkestra, without having to re-enter their credentials.

Technical Configuration

Enabling SAML2 SSO requires the following elements:

Element	Description
Valid X.509 certificate	Used to sign and validate SAML exchanges between Orkestra and the IdP.
IdP metadata	Provided by the identity service (e.g., an XML file containing the endpoints and public keys).
Entry point URL (Single Sign-On URL)	Redirect address to the identity provider.
Audience / Entity ID	Orkestra's unique identifier with the IdP.

These settings are configured in the appsettings.json files.

Note

SSO mode replaces LDAP or internal authentication when the SAML2 protocol is enabled.

It must be enabled by a system administrator with rights on the IIS server and certificates. See the SAML installation manual.

Creating a User with SSO Enabled

When Orkestra is configured with SSO:

• Creating a user does not require a password in the administration interface.
• The Login field must match the unique identifier sent by the identity provider (often the professional email address).

Managing Rights and Roles

SSO authentication does not change how Orkestra's internal permissions are managed:

• The roles (« Visualisateur » (Viewer), « Créateur » (Creator), « Super-Admin » (Super Admin)) remain defined in Administration / Users.
• Application rights are assigned in the same way as for an SSO, LDAP, or internal user.
• DTF and DTS restrictions continue to apply as usual.

Process with LDAP Authentication

This process applies to Orkestra platforms installed with authentication linked to the company's LDAP.

Actions:

1. Go to Settings/Administration/User
2. Click "+ Ajouter" (+ Add) on the horizontal menu

3. Enter the required information in the user creation pop-up

Note

• Status: select Active/Inactive
• DO NOT check the "Authentification interne" (Internal Authentication) box
• Login: enter the NETWORK login (the same one used, for example, to open a Windows session)

4. Then click Save

Access to the platform is then done by entering the network login and password.

Process with Internal Authentication

This process applies to Orkestra platforms installed on a network, but where user authentication is self-contained, i.e., not connected to the company's LDAP.

Actions:

1. Go to Settings/Administration/User
2. Click "+ Ajouter" (+ Add) on the horizontal menu
3. Enter the required information in the user creation pop-up

Note

• Status: select Active/Inactive
• Check the "Authentification interne" (Internal Authentication) box
• Login: enter a login of your choice

4. Then click Save. The new user then appears in the list of created users.

Note

With internal authentication only, the associated password defaults to the user's login. It is recommended to change it at first login (see below).

Once logged in under their profile, the user can change their password via the Profile screen, Security tab.

Assigning Roles

Now that the user has been created, roles must be assigned to them. To do this:

1. Click the black arrow, then "+ Ajouter" (+ Add)

Information to fill in:

• Status: select Active/Inactive
• Application: select the application

Note

ETL, MSO, and ParallelU are not applicable

• Choose a role (from most restrictive to most open):
  • « Visualisateur » (Viewer)
  • « Créateur » (Creator)
  • « Data Driven » (only relevant for Data Fabrik)*
  • « Admin-Exploit » (not applicable)
  • « Admin Référentiels » (Reference Data Admin) (not applicable)
  • « Super-Admin » (also called « Administrateur » (Administrator))
• Assignment description: enter a comment of your choice

2. Click Save

*This role is only needed to grant a user access to a restricted list of UTD/Modules. It must therefore not be combined with « Visualisateur » (Viewer), « Créateur » (Creator), or « Administrateur » (Administrator) (see the "DTF Permissions – Restricting UTD/Module Access" section).

The user has been updated:

Managing a User

Editing General Information

You can edit a user's general information by selecting the row and clicking "Editer" (Edit), or by double-clicking it.

Editing Permissions

Similarly:

1. Select the user's row
2. Click the black arrow
3. Select the permission to edit
4. Click "Editer" (Edit) or double-click the row

Role changes will be visible to the affected user the next time they log in to the site. If they are already logged in, they must log out and log back in.

List of Application / Role Actions

Application	Screen	Tab / Level	Action	« Visualisateur » (Viewer) (read)	« Créateur » (Creator) (read/write)	« Administrateur » (Administrator) (read/write/config)
Data Fabrik	UTD Production			X	X	X
			Produce		X	X
	Production Calendar	Calendar		X	X	X
		Scheduling		X	X	X
			Edit the schedule		X	X
			Duplicate the schedule		X	X
			Disable the schedule		X	X
Data Gouvernance	Governance Actions	Actions		X	X	X
			Edit / double-click a row		X	X
		Management		X	X	X
			Edit / double-click a row		X	X
			Quick permission management		X	X
		History		X	X	X
		Instantiated Lineage		X	X	X
	Governance Context			X	X	X
			Access the tree view	X	X	X
	Production Quality			X	X	X
			Download the compendium		X	X
Data Shop	Data Product			X	X	X
	Orders	List		X	X	X
			Order	X	X	X
			Download documents		X	X
			Edit the order		X	X
			Cancel the order		X	X
			Duplicate the order		X	X
		Tracking		X	X	X
			Move tiles	X	X	X
UTD Manager	Declaration			X	X	X
			Add		X	X
			Edit		X	X
			Disable		X	X
	UTD Version			X	X	X
			Add		X	X
			Edit		X	X
			Download blank environment		X	X
			Manage blank environment		X	X
			Catalog		X	X
			Duplicate		X	X
	UTD Version Module			X	X	X
			Add		X	X
			Edit		X	X
			Magnifying glass (view)	X	X	X
			Manage associations		X	X
Tag Manager	Configurator	Tagged Objects		X	X	X
			Add		X	X
			Edit		X	X
			Delete		X	X
			CSV export		X	X
			Edit a rule		X	X
		Scopes		X	X	X
			Add		X	X
			Edit		X	X
			Delete		X	X
		Domains		X	X	X
			Add		X	X
			Edit		X	X
			Delete		X	X
	Simulator		Evaluate the tag	X	X	X
	Rule Customization	Governance Rules		X	X	X
		Rule Values		X	X	X
		Linked Rule Values		X	X	X
	Configuration	Object Formats		X	X	X
			Add			X
			Edit			X
		Object Types		X	X	X
			Add			X
			Edit			X
		Domain Types		X	X	X
		Tag Codification		X	X	X
		Event Types		X	X	X
			Add			X
			Edit			X
		Resource Types (inputs)		X	X	X
			Add			X
			Edit			X
		Actions		X	X	X
REF Manager	Reference Datasets		Display	X	X	X
			Force reload		X	X
			Clone		X	X
			Validate		X	X
			Add		X	X
			Edit		X	X
			Delete		X	X
	History			X	X	X
	Configuration	Configuration		X	X	X
			Add			X
			Edit			X
			Delete			X
		Connections
			Add			X
			Edit			X
			Delete			X

Logs: applicable via the "Administration" application in a user's configuration.

Application	Screen	Tab / Level	Action	« Visualisateur » (Viewer) (read)	« Créateur » (Creator) (read/write)	« Administrateur » (Administrator) (read/write/config)
Logs	Parallel U Instances				X	X
			Service started		X	X
	Orkestra Logs				X	X
UTD	Logs			X	X	X
	Tracking			X	X	X
			Download		X	X
Administration	Users			X	X	X
			Add		X	X
			Edit		X	X
			Add role		X	X
			Edit role		X	X
			Delete role		X	X
	Permissions	DTF / Associations		X	X	X
			Add		X	X
			Edit		X	X
		DTF / Duplicate Rights		X	X	X
			Save		X	X
		DTS		X	X	X
			Add		X	X
			Edit		X	X

Configuration: the Tag Manager and REF Manager submenus are described above (pages 14 to 16 of the source manual). Application "Rôles" (Roles) are not configurable.

Application	Screen	Tab / Level	Action	« Visualisateur » (Viewer) (read)	« Créateur » (Creator) (read/write)	« Administrateur » (Administrator) (read/write/config)
Configuration	Email Templates			X	X	X
			Edit	X	X	X
			Edit / Save			X
	Parallel U Instances	Categories		X	X	X
			Add			X
			Edit			X
			Delete			X
		Servers		X	X	X
			Add			X
			Edit			X
		Server Settings		X	X	X
			Add			X
			Edit			X
		Parallel U Clients		X	X	X
			Add			X
			Edit			X
		Parallel U Client Settings		X	X	X
			Add			X
			Edit			X
		Farms		X	X	X
			Add			X
			Edit			X
		Parallel U Client Farms		X	X	X
			Add			X
			Edit			X
		Software		X	X	X
			Add			X
			Edit			X
		Software Versions		X	X	X
			Add			X
			Edit			X

DTF Permissions – Restricting UTD/Module Access

The « CREATEUR » (Creator) and « ADMINISTRATEUR » (Administrator) roles, when assigned to a user on the Data Fabrik application, grant access to the production function on ALL UTDs and ALL MODULES.

If it is necessary to restrict this access to certain UTDs and/or MODULEs, the « DATA DRIVEN » role must be assigned to the user instead. The « CREATEUR » (Creator) or « ADMINISTRATEUR » (Administrator) roles must then be DISABLED. It will then be possible to configure the user's access through the Permissions menu described below.

To do this, go to the SETTINGS/Administration/Permissions menu, available in the left-hand vertical menu.

Creating a DTF Permission

Information to enter:

• User: select the relevant user
• Profile (see the summary of rights granted per profile below):
  • « Contremaitre » (Foreman)
  • « Contrôleur » (Controller)
  • « Producteur » (Producer)
• Category: filters the list of UTD/Modules in the next field among the existing categories
• Module: selects the UTD and/or module(s) for which the user will be granted access
• Comment: enter a free-text comment

Then:

• Click Save

Summary of rights granted per profile:

Function	Actions/Profile	« Producteur » (Producer)	« Contrôleur » (Controller)	« Contremaitre » (Foreman)
DATA PROCESSING UNIT (UTD)	Produce	1
DATA PROCESSING UNIT (UTD)	Stop a request	1
DATA PROCESSING UNIT (UTD)	Download resources	1	1
DATA PROCESSING UNIT (UTD)	Download controls	1	1
DATA PROCESSING UNIT (UTD)	Download results	1	1	1
DATA PROCESSING UNIT (UTD)	Information	1	1	1
DATA PROCESSING UNIT (UTD)	View requests	1	1	1
SCHEDULES	Duplicate a schedule	1
SCHEDULES	Edit a schedule	1
SCHEDULES	Cancel a schedule	1
SCHEDULES	View a schedule	1	1
SCHEDULES	Download resources	1	1

The result appears as follows:

Duplicating a DTF Permission

You can duplicate a user's rights based on another user's permissions using the "DUPLIQUER LES DROITS" (Duplicate Rights) function.

1. Select the Target user
2. Then the Template user
3. Click Save

Note

The Template user's permissions are ADDED to those already in place on the TARGET user

Editing a DTF Permission

Editing a permission consists of making it inactive.

If the user needs to have a Profile change applied (« Contremaitre » (Foreman), « Contrôleur » (Controller), or « Producteur » (Producer)), then the existing permission should be deactivated and a new one created.

Actions:

1. Select a row to edit
2. Click Edit
3. Change the status to "Inactif" (Inactive)
4. Save

DTS Permissions

Permissions can also be used to grant usage rights directly on a tag — that is, on a production result. The effects are the same as those of a distribution governance action (see the "Governance Manual" guide).

This is configured via the Settings/Administration/Permissions/DTS menu:

Creating a DTS Permission

To create an access right to a tag for a user, the tag must be associated with that user. To do this:

1. Click "+ Ajouter" (+ Add)
2. User: select the relevant user
3. Tag: select the relevant tag
4. Comment: enter a free-text comment
5. Save

The new row appears.

The user will then see the dataset associated with this tag in the Data Shop.

Editing a Permission

1. Select the row to edit

2. Click "Editer" (Edit), or double-click
3. Change the status to "Inactif" (Inactive)
4. Comment: enter a free-text comment
5. Save

User Templates

Simplify role configuration by allowing the creation of template accounts that serve as a reference for quickly assigning consistent sets of rights to other users.

A template user is a special account configured by an administrator:

• It cannot log in to the platform.
• Its operation type is Template.
• It has a complete permission configuration (applications and roles).
• Its rights can be duplicated onto one or more real users.

Examples of templates:

• MODELE_SUPERADMIN: has full rights over all modules.
• MODELE_DTF_CREATOR: configured for a "Data Fabrik Creator" profile.
• MODELE_REF_VIEWER: reserved for viewing reference datasets.

Interface and Duplicating Rights

A new feature, "Dupliquer les droits à partir d'un utilisateur modèle" (Duplicate rights from a template user), is available from the menu:

Settings / Administration / Permissions / Users

The template user's rights replace those of the target user.

The KADMIN User

By default, when the platform is installed, an initial user is created named KADMIN.

Default Password

A default password is set during installation (see the installation guide).

After installation, the first login must be performed with this user, and the password must be changed.

It is then necessary to:

• Create a new USER of type Administrator
• Change KADMIN's access password or disable the account.