Sign-in and access
Who is who. An admin manages people, access and folders and can do everything on every dataset. Everyone else is a member and only sees the datasets they've been given. Access is granted on all datasets, a folder (covers its sub-folders and future datasets in it) or one dataset, at one of three levels:
| Level | Can |
|---|---|
| Viewer | see, search, export, comment, query it with SQL (CLI and SDK) |
| Editor | + draft and submit changes, fix issues, undo |
| Owner | + rules, business details, approve changes, restore versions, see its audit log; create datasets in owned folders |
Roles. Access is given to roles (Admin › Users › Roles), for example Finance stewards: owner of the Finance folder or Read everything: viewer of all datasets, and admins add people to roles, as in Snowflake, Databricks or GitHub teams. A joiner gets the right access by joining a role and a leaver loses it by leaving; a role's change reaches all its members at once. One-off access can still be given to a person directly. Each person's panel shows what they can open and why (e.g. "role Finance stewards · folder Finance").
The highest matching grant wins, from all of a person's roles and their own grants; record limits (e.g. market = DK) narrow it further. Datasets someone can't see answer 404, and are left out of search, SQL, the graph, issues and approvals. Approvers are the dataset's owners (or the named approvers who can still edit it). All user and access changes are in the audit log.
Signing in.
- Password: an admin adds the person and passes on a one-time temporary password; they choose their own at first sign-in. Forgotten passwords are reset by an admin (signs them out everywhere).
- Single sign-on: set the
MDM_OIDC_*variables below. Works with Microsoft Entra ID, Google, Okta, Keycloak, Auth0 or any OpenID Connect provider (authorization code + PKCE). Register the redirect URI<MDM_PUBLIC_URL>/api/auth/sso/callback. Only people with an account can sign in, unlessMDM_OIDC_AUTO_CREATE=true(new people then arrive with no access, and admins are notified). - The browser gets an HttpOnly, SameSite session cookie (12 h by default); writes also need an
X-Requested-Withheader, so other sites can't post on someone's behalf. - Scripts: personal API tokens (Settings › API tokens) in the
X-API-Keyheader; they act with the owner's access.