Skip to content

Commit 239970b

Browse files
author
SPRINX0\prochazka
committed
admin docs
1 parent e09a352 commit 239970b

File tree

7 files changed

+126
-67
lines changed

7 files changed

+126
-67
lines changed

‎content/admin.md‎

Lines changed: 0 additions & 67 deletions
This file was deleted.

‎content/admin/_index.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
title: Adminstration
3+
weight: 110
4+
---
5+
6+
Administration tool is available only on Team Premium edition. In Community edition, please use configuration using [environment variables](/env-variables)
7+
8+
All configuration from administration is saved into database, use [STORAGE_xxx environment variables](/env-variables/#premium-edition-configuration) for configure this.
9+
10+
## Administrator access
11+
12+
Administration page is available on URL https://your_dbgate_instance/admin.html .
13+
14+
Root adminstrator should have password defined. You could set environment variable ADMIN_PASSWORD. If this variable is not defined, DbGate asks for admin password at first.
15+
16+
You could then add administration permission to different user with different authentication method, but at first, you have to open this admin page.
17+

‎content/admin/auth.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
---
2+
title: Authentication
3+
weight: 10
4+
---
5+
6+
## Authentication tab
7+
![Authentication administration - DbGate](https://media.dbgate.io/img/authentication-administration-light.png)
8+
9+
There are several methods of authentication. Use will choose authentication method on login page. If you have only one authentication method enabled and authentication method doesn't require login page, login page is skipped.
10+
11+
- Local authentication method - user is selected from user list in storage database (configured in "Users" tab)
12+
- Anonymous - no credentials are required, user have permissions from "anonymous-user" role
13+
- Use database login - credentials are redirected to database server. User will choose connection from "Connections" tab
14+
- OAuth 2.0 - generic OAuth provider. With some little effort and proper knowledge, could be configured with most of recent identity providers, like Google, Facebook, Keycloak
15+
- Active Directory - AD access via LDAP protocol
16+
- Microsoft Entra - former Azure Active Directory - single sign-on access to Azure databases
17+
18+
### Option "Allow only defined logins"
19+
For external identity providers, user doesn't have to exist in DbGate storage database. If this checkbox is checked, user, which is not found in storage database, is not allowed to login

‎content/admin/connection.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
title: Connections
3+
weight: 20
4+
---
5+
6+
## Connections tab
7+
Configure connections available in DbGate. Connections must be mapped to users or roles to be available.
8+
9+
![Connections administration - DbGate](https://media.dbgate.io/img/connection-administration-light.png)
10+
11+
## Direct access to storage database
12+
Admin user has also access to internal storage database, so you could make operations on database directly (eg. exports/imports of users etc.). This permission could be also granted to any other user, "Interal storage" permission

‎content/admin/permissions.md‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
---
2+
title: Permissions
3+
weight: 50
4+
---
5+
6+
## Permissions system
7+
DbGate uses permission system with two dimensional hiearchy.
8+
9+
One hiearchy dimension is inheritance of permissions from roles.
10+
- Predefined permission set
11+
- Predefined role (superadmin/logged-user/anonymous user)
12+
- Custom roles
13+
- User
14+
15+
The second hiearchy dimension is inheritance from parent roles.
16+
17+
## Database permissions
18+
You could configure permissions related to database on "Databases" tab (in Role detail and in User detail)
19+
20+
Database permissions are not used, unless **"All databases"** is permission is active
21+
22+
Each line of databases permission rules table defines permission to matched database. The order of rules is important, permissions at the bottom override permissions at the top.
23+
24+
![Database permissions - DbGate](https://media.dbgate.io/img/dbpermissions-light.png)
25+
26+
**Columns:**
27+
* Connection - define, on which connection this rule is applied
28+
* Database names - define database name (by list of names or by regular expression)
29+
* Role:
30+
* View - view database, without access to tables, views, etc.
31+
* Read content - access to database content, readonly
32+
* Write data - change data of tables
33+
* Run script - run any SQL script, create/drop/alter tables
34+
* Deny - don't allow access to this database
35+
36+
## Table Permissions
37+
You could configure permissions related to database on "Tables/Views/Objects" tab (in Role detail and in User detail)
38+
39+
Tables permissions are not used, unless **"All tables/views/objects"** is permission is active
40+
41+
Each line of databases permission rules table defines permission to matched table. The order of rules is important, permissions at the bottom override permissions at the top.
42+
43+
**Columns:**
44+
* Connection - define, on which connection this rule is applied
45+
* Database names - define database name (by list of names or by regular expression)
46+
* Schema names - define schema name (by list of names or by regular expression)
47+
* Table names - define table/view/procedure/trigger name (by list of names or by regular expression)
48+
* Scope - defines types of matched object
49+
* Role:
50+
* Read - read table data
51+
* Update only - update table rows, don't allow to insert and delete operations
52+
* Run script - allow to run script with this table. In fact, if you don't have "Run script" permission on database level, this cannot be used
53+
* Deny - don't allow access to this table
54+

‎content/admin/roles.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
title: Roles
3+
weight: 40
4+
---
5+
6+
## Roles tab
7+
Configure roles, role permissions and role-connection mapping. You could create custom roles and assign users to them, so that permissions and linked connections are shared between all users assigned to this role.
8+
9+
There are some predefined roles:
10+
- superadmin - role used for admin page, https://your_dbgate_instance/admin.html
11+
- logged-user - role used for all logged users. You could ovveride permission for specific users
12+
- anonymous-user - role used for users logged with "Anonymous" authentication method
13+
14+
![Role administration - DbGate](https://media.dbgate.io/img/role-administration-light.png)

‎content/admin/users.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
title: Users
3+
weight: 30
4+
---
5+
6+
## Users tab
7+
Configure users, passwords, user permissions and user-connection mapping.
8+
Passwords are used only for "Local" authentication methods. But all methods with external identity providers use user lookup, so you could configure permissions and connections available for user, even for externaly authenticated user.
9+
10+
![Role administration - DbGate](https://media.dbgate.io/img/user-administration-light.png)

0 commit comments

Comments
 (0)