Authorization

In Anjana Data, user authorization is based on the assignment of roles to people within organizational units (OUs). This combination determines which actions each user can perform and in which scopes within the platform.

Table User-Ou-Roles in the Configuration Panel (Administrator view)

The management of these assignments is carried out through the Users-OU-Roles table, which acts as the central mechanism for permission control.

Structure of the Roles table

Each record in the users_ou_role table defines a unique assignment between a user, an organizational unit and a role.
The elements that characterize this assignment are:

• user: unique identifier of the user.

  • Corresponds to the id field of the Users table.

• ou: unique identifier of the Organizational Unit.

  • Corresponds to the id field of the Organizational Unit table.

• role: unique identifier of the role.

  • Corresponds to the id field of the Roles table.

Assigning roles to users

Assigning cross roles

To assign a user a role that has been configured as Cross (see configuration of the Roles table) the following steps must be followed:

1. Click the New button in the top right corner. This will open an assistant (wizard) with the fields defined in the Structure section.

2. Fill in the fields as follows:

   1. user: Select the user identifier. If the user does not exist, it must be created beforehand.

   2. ou: Select the default Cross unit. This OU is created internally by the platform; however, if it has been deleted manually, it must be created in order to authorize cross roles.

   3. role: Select the role from among the previously configured roles. If the role does not exist, it must be created beforehand.

3. Click Save to save the role or Cancel to discard it.

Assigning vertical roles

To assign a user a vertical role that has not been configured as cross (see configuration of the Roles table), the following steps must be followed:

1. Click the New button in the top right corner. This will open an assistant (wizard) with the fields defined in the Structure section.

2. Fill in the fields as follows:

   1. user: Select the user identifier. If the user does not exist, it must be created beforehand.

   2. ou: Select the corresponding leaf organizational unit. If it does not exist, it must be created beforehand.

   3. role: Select the role from among the previously configured roles. If the role does not exist, it must be created beforehand.

3. Click Save to save the role or Cancel to discard it.

Modifying authorizations

To modify the assignment of roles to users in organizational units, this can be done by deleting a record and creating a new one.

Querying and using authorization data in the database (Developer view)

In addition to being configured from the Configuration Panel, the assignment of roles to users is stored in the database and can be queried in read-only mode to use it for analytical purposes. For example, it allows the customer to build their own data mart, dashboards or reports on the authorization of their platform (which users hold which roles in which data domains).

Table zeus.user_ou_role

The assignment of roles to users is stored in the zeus.user_ou_role table. Each record represents a unique user-organizational unit-role assignment. Its columns, available for querying, are:

Related tables (foreign keys)

The table is joined with the following model tables to resolve identifiers and enrich queries:

Query examples

Resolved authorizations (user, organizational unit and role):

SELECT uor.user_id,
       ou.alias      AS unidad_organizativa,
       r.role_name   AS rol
FROM zeus.user_ou_role uor
JOIN zeus.organizational_unit ou ON uor.ou_id = ou.id_organizational_unit
JOIN zeus."role" r            ON uor.rol_id = r.id_role
ORDER BY uor.user_id;

Roles assigned to a specific user (by their identifier):

SELECT ou.alias AS unidad_organizativa,
       r.role_name AS rol
FROM zeus.user_ou_role uor
JOIN zeus.organizational_unit ou ON uor.ou_id = ou.id_organizational_unit
JOIN zeus."role" r            ON uor.rol_id = r.id_role
WHERE uor.user_id = 2;

Count of assignments by role (useful as a metric for a data mart):

SELECT r.role_name,
       COUNT(*) AS asignaciones
FROM zeus.user_ou_role uor
JOIN zeus."role" r ON uor.rol_id = r.id_role
GROUP BY r.role_name
ORDER BY asignaciones DESC;