Identity Provider Roles
Identity provider roles define your identity and control which platform features you can access. These roles come from Ataccama’s identity provider, which synchronizes with your organization’s identity provider and passes roles to Ataccama ONE.
| We do not recommend creating new identity provider roles in ONE nor editing the existing ones. Contact your identity provider admin if any changes are required. |
What identity provider roles are for
Identity provider roles serve two purposes:
-
Control feature access: Determine which platform features you can use.
-
Simplify governance role assignment: Can be mapped to governance roles within groups, so you automatically receive the appropriate permissions.
Some platform features require specific identity provider roles. See Reserved identity provider roles.
Environment admins
During environment setup, environment admin users are designated through the Ataccama Cloud Portal. These admins are imported into ONE and automatically receive the ataccama-admin role.
ataccama-admin is a composite role that grants full platform admin privileges. It bundles the admin roles of the individual platform modules, so you don’t need to assign them one by one. This includes every admin role listed in Reserved identity provider roles, such as organizationconfig-admin, metadata-admin, and contentorchestrator-promotion-admin, as well as a few module-internal admin roles.
If your organization signs in through SSO, the equivalent role is ataccama-admin-idp. It grants the same privileges but is mapped to a group in your identity provider instead of being granted through the Cloud Portal. See Assign roles through your identity provider.
For security reasons, neither role can be assigned in ONE. If you need admin-level access, contact your environment admin.
Default role assigned to every user
Every user account in ONE includes a role named default-roles-<tenant-name>, for example, default-roles-acme-production.
<tenant-name> matches your environment’s tenant name, shown in the Ataccama Cloud Portal.
The role is generated and maintained by the Ataccama identity provider, and assigned to every user automatically, including users who sign in through your organization’s identity provider and aren’t a member of any group mapped in ONE.
In ONE, default-roles-<tenant-name> carries no permissions. It isn’t mapped to any group or governance role, and you can’t edit, remove, or extend it. You might come across it in Global settings > User management > Roles, but you can otherwise ignore it.
The role also has no effect on who can sign in to ONE. Sign-in is managed entirely by your organization’s identity provider, such as application or group assignment in Entra ID or Okta. See Set Up Entra ID SSO or Set Up Okta SSO to control which users can sign in.
How identity provider roles are assigned
Reserved identity provider roles reach users in one of three ways:
-
Automatically, through the Cloud Portal: Environment admins designated in the Cloud Portal receive ataccama-admin and everything it bundles. See Environment admins.
-
Through your identity provider: Users who sign in through SSO receive roles based on the identity provider groups they belong to. This is the recommended approach for production environments. See Assign roles through your identity provider.
-
Manually in ONE: You assign a role to an individual user in Global settings > User management. This is intended for initial implementation and non-production environments. See Assign identity provider roles in ONE.
Assign roles through your identity provider
Users who sign in through SSO don’t receive reserved roles automatically. They receive only the roles mapped to their identity provider groups in the Cloud Portal.
Each identity provider group can be mapped to a single role.
To grant several reserved roles, create one group per role in your identity provider, then map each group to the corresponding role in the Cloud Portal.
For example, map a group named ataccama-admins to ataccama-admin-idp and a group named ataccama-ai-agent-users to antaiagent-user.
Because the mapping is maintained in your identity provider, adding a user to the right group is all that’s needed to grant them the role, and removing them from the group revokes it.
For step-by-step instructions, see the Group import section in Set Up Entra ID SSO or Set Up Okta SSO.
Assign identity provider roles in ONE
You can assign and remove some reserved identity provider roles directly in ONE. Use this approach during initial implementation or in non-production environments. In production, assign roles through your identity provider instead, so that role assignments are managed in one place together with your users and groups.
|
Prerequisites
To edit identity provider roles in ONE, you need the organizationconfig-admin role. Environment admins receive this role automatically. |
To manage a user’s identity provider roles:
-
Go to Global settings > User management > Users.
To access Global settings, select the Ataccama logo. -
Select a user to open their details.
-
Select Assign roles to add roles, or select the X icon next to a role to remove it.
When you assign or remove a role, synchronization between the identity provider and ONE starts automatically and no further action is needed.
| If you’ve assigned a role but the user still can’t access the feature, have them log out and log back in. |
Roles that can’t be assigned in ONE
Some reserved roles are restricted, which means they can be granted only through the Cloud Portal or your identity provider. Restricted roles don’t appear in the Assign roles dialog, and if a user already has one, it can’t be removed on the user’s detail page.
Of the roles listed in Reserved identity provider roles, only the composite admin roles (ataccama-admin, ataccama-admin-idp) and metadata-admin are restricted. The remaining restricted roles are technical roles used by ONE itself. See Other roles in your environment.
Reserved identity provider roles
Certain identity provider roles are loaded from the identity provider but are built-in within ONE. In other words, these roles grant you specific capabilities, without which you cannot access a certain module or action.
| For the majority of functionalities, no identity provider role is needed. Access is instead handled using access levels, assigned through stewardship or sharing. |
The following roles are built-in in ONE:
| Functionality | Role | Description |
|---|---|---|
Platform administration |
|
Full platform admin. Composite roles that bundle the admin roles of the individual modules. ataccama-admin is granted to environment admins designated in the Cloud Portal; ataccama-admin-idp is mapped to a group in your identity provider. Can’t be assigned in ONE. |
organizationconfig-admin |
Can manage users and their identity provider roles in Global settings > User management. Included in the composite admin roles. |
|
Metadata administration |
metadata-admin |
Super-admin for the metadata server. Intended for users who set up permissions for everyone else. Can’t be assigned in ONE. |
|
Can use AI features but cannot manage AI settings (such as which tools are allowed). antaiagent-user is the role for the AI Agent. |
|
|
Can manage AI settings and use all AI features. |
|
dataobservability-admin |
Can manage Data Observability settings. |
|
|
Superuser for lineage. |
|
|
Read and write access, can run lineage import. |
|
|
Read-only access, can view lineage diagrams. |
|
dpm-admin |
Can access DPM jobs in the Processing Center. These jobs might contain details that should be available only to admin users. |
|
notifications-admin |
Can manage notification settings. |
|
workflows-admin |
Can configure workflows for the environment, such as default assignees and approval processes. |
|
contentorchestrator-promotion-admin |
Can manage the environments and promotion settings for asset promotion. Granted automatically to the environment admins defined in the Ataccama Cloud Portal. |
|
contentorchestrator-export-operator |
Can create and delete exports and the content packages they produce. |
|
contentorchestrator-promotion-publisher |
Can publish content packages to other environments and withdraw them. |
|
contentorchestrator-import-promotion-operator |
Can import available content packages into the target environment. |
Other roles in your environment
In Global settings > User management > Roles, you might see roles that aren’t listed in the table, for example, metadata-export, notifications-trigger, or contentorchestrator-preset-admin. These roles are used internally by ONE modules and the identity provider.
Don’t assign them to users unless instructed to by Ataccama Support.
API client roles
Each API client created in the Ataccama Cloud Portal has a dedicated role, named after the client with the publicapi- prefix.
Don’t assign these roles to users or edit them.
To grant API clients access to assets, see Manage API Client Access.
Was this page useful?