Skip to main content

User Management

Configure user authentication mechanisms, manage user permissions, and manage existing users.

Authentication Mechanisms​

On first install, the QS defaults to Windows authentication. To set up the QS to use an ADFS server, follow the "Installation and Configuration" guide using the section "ADFS". To use forms based authentication, disable all other authentication methods in IIS other than: Anonymous and Forms:

To use authentication forms:

Step 1 – Check that the “authentication mode” setting in conceptQS/web.config file is set as follows:

  • (This is the default setting.)

Step 2 – Check that the Authentication settings are correct in IIS for Windows Authentication:

The NDC web application must have these authentication methods enabled:

  • Anonymous Authentication
  • Windows Authentication

Disable all other authentication methods.

iis_thumb_0_0

Step 3 – If you want to allow anonymous access to NDC, edit the conceptQS web.config file and delete (or comment out) three lines:

*

If these lines are present, users must log in using their Windows credentials.

Configure Microsoft Entra ID Authentication​

To configure Microsoft Entra ID you need to create a client application and add two new appSettings to the "<appsettings>" section of the web.config file in the QS directory:

  • <add key="ida:AzureClientId" value="NewAzureADClientID (GUID)" />
  • <add key="ida:AzureAuthority" value="AzureADAuthorityValue such as: https://login.windows.net/mytenant.onmicrosoft.com" />

The Netwrix Data Classification REST APIs also support Bearer-based authentication. To enable this mode, add one further appSetting entry into the web.config file:

  • <add key="ida:AzureTenant" value="Tenant Name such as: netwrix.com" />

In the QS, settings are split between Basic and Advanced. Users wishing to always see Advanced options can enable this by:

  • Selecting their username from the footer of the application
  • Clicking User Preferences
  • Ticking Always Show Advanced Settings
  • Clicking Save

See the following Knowledge Base article to learn how to set up single sign-on for Netwrix Data Classification via Microsoft Entra ID authentication: How to Set Up SSO via Microsoft Entra ID Authentication.

Add or Remove Users​

You can add and remove users via the Users screen at any time.

adduser

You can validate additional Windows users using Integrated Windows Authentication. You can only add additional non-Windows users if the Non-Windows Authentication mode is enabled.

If you delete the only Super User, the system removes all security and reverts the QS administrative functions to unrestricted access.

User accounts with REST API access are still restricted by their specific permissions. A Super User with REST API access will be able to run any API method. Any normal user will be restricted by the same rules that govern the UI. Further API samples and documentation can be found at: /NDC/_api

Permission Management​

To allocate granular permissions to a user (non-Super Users), click Edit on their row in the Users table. The permissions for each section of the administrative web interface will be displayed as tabs. Each tab contains a top-level checkbox of the form "Access [Area Name]” (e.g. Access Sources) which defines whether a user has access to each of the top level administrative areas.

When an area is enabled there are typically more granular permissions that can be enabled, such as:

  • Within the Taxonomies area, you can also assign permissions at a specific Term Set or Term branch level. A full user permission summary (for all Term/Set level permissions) can be viewed by selecting the View Taxonomy Permissions button.
  • Within the Sources area, you can restrict a user’s access to specific source groups, as shown in the following image.

userpermissions_thumb_0_0

Permissions Summary​

The Permissions window lets you set permissions for the selected user.

viewtaxonomypermissionssummary_thumb_0_0

You can restrict permissions for a user to the following areas:

Super Users​

Super Users have access to all Query Server administrative functions.

Non-Super Users must have their access rights specifically configured and all rights are disabled by default. See User Management section for details about configuring the access rights for non-Super Users.

Regardless of the authentication mode selected the usage of the QS administrative functions will continue to be unrestricted until at least one user is added. The first user must be a Super User. If Windows or ADFS Authentication are being used then the first user will default to the logged-in user, although this can be changed if required.

If Non-Windows Authentication is enabled then additional information must be entered to define the non-Windows user.