Managing users and roles (Data Virtualization)

Data Virtualization has four user roles, which are specific to the Data Virtualization environment. You can grant these roles to existing Cloud Pak for Data users.

Data Virtualization roles
Permissions of Data Virtualization roles

Data Virtualization roles

In order for a user to have access to the Data Virtualization service, you must assign them one of the following Data Virtualization roles:

Data Virtualization Admin: The user who provisions the Data Virtualization service is automatically assigned the Data Virtualization Admin role. After the service is provisioned, the Data Virtualization Admin can give other users access to the service.
The Data Virtualization Admin is considered to be the manager of the Data Virtualization instance and assigns appropriate Data Virtualization roles to Cloud Pak for Data users.
Data Virtualization Engineer: Configures the data sources, virtualizes data, and manages access to virtual objects. Users with this role can create a virtual table or view and grant access to it to users with any Data Virtualization role. By default, every virtual object that is created in Data Virtualization is private. This privacy means that in order for a virtual object to be accessed by a user other than its creator, access to the virtual object must be granted.
Restriction:
When previewing Data Virtualization data assets in Watson™ modules in Cloud Pak for Data (for example, Watson Knowledge Catalog, Watson Studio, and Data Refinery), and in cases when data masking applies, the preview is subject to the data protection rules and catalog or project access control only.

Data Virtualization access control is not enforced when masking applies to the asset and you must define your rules to manage access to the catalogs, projects, data assets, or connections for access control in Watson modules.

Tech preview This is a technology preview and is not supported for use in production environments.

Data source administrators are expected to provide access to a Data Virtualization Engineer to virtualize data. Users with this role service and fulfill data requests from Data Virtualization users.
Data Virtualization User: Data Virtualization users can request access to virtualized data or data in general by initiating a data request. Users with this role can create views of virtual tables to which they have access.
Data Virtualization Steward: Data Virtualization Stewards can access data in all user tables and views. Additionally, Stewards hold the Db2® DATAACCESS authority on the database.

The following table summarizes the Data Virtualization menu functions that each of the Data Virtualization user roles is able to access.

Data Virtualization features	Admin	Engineer	User	Steward
Provision Data Virtualization	✓
User management	✓
Data sources	✓	✓
Virtualize	✓	✓
My virtualized data	✓	✓	✓	✓
Connection details	✓	✓	✓	✓
Service settings^*	✓	✓	✓	✓
SQL editor	✓	✓	✓	✓

Required role: ^*To modify the service settings, you must have the Data Virtualization Admin role.

Permissions of Data Virtualization roles

The following table describes the permissions that are associated with each Data Virtualization role.

Roles	Permissions
Data Virtualization Admin	Administer the service Administer the database Access data Manage data sources Manage users and assign Data Virtualization roles Create and share any schema Manage data caches Manage data queries
Data Virtualization Engineer	Access connection details Manage data sources Create virtual tables and views Create and manage private schema
Data Virtualization User	Access connection details Create virtual views over existing virtual tables and views Create and manage private schema
Data Virtualization Steward	Access connection details Access data Create virtual views over existing virtual tables and views Create and manage private schema

Important: To grant another user control on an object, including privileges to grant permissions to other users, and to remove a virtual object, the target user or role must be granted the CONTROL privilege on that object. For example:

GRANT CONTROL on object to ROLE DV_ENGINEER

For more information about the CONTROL privilege, see the Db2 product documentation.