User ManagementUser ManagementThe user management view allows to manage the permissions of the system users. Sets of permissions are organized into roles that can be assigned to a particular user. Data roles, also called entitlements, are sets of permissions defined per VDB that dictate data access (create, read, update, delete, execute,alter).
Data roles use a fine-grained permission system that CData Virtuality Server will enforce at runtime and provide audit log entries for access violations. Prior to applying data roles, you should consider restricting source system access. Foremost, CData Virtuality Server can only access source entries that are represented in imported metadata.
There are two categories of users and roles:
and roles 
are created manually, they are fully editable and marked with blue-colored icons.
and roles 
. They are unmodifiable and marked with orange-colored icons. There are 3 predefined roles:
CRUDEAL permissions can be set for any resource path in a VDB. A resource path can be as specific as the fully qualified name of a column or as general a top level model (schema) name.
Permissions granted to a particular path apply to it and any resource paths that share the same partial name. For example, granting read to "model" will also grant read to "model.table", "model.table.column", etc. Allowing or denying a particular action is determined by searching for permissions from the most to least specific resource paths. The first permission found with a specific allow or deny will be used. Thus it is possible to set very general permissions at high-level resource path names and to override only as necessary at more specific resource paths.
Permission grants are only needed for resources that a role needs access to. Permissions are also only applied to the columns/tables/procedures in the user query - not to every resource accessed transitively through view and procedure definitions. It is important therefore to ensure that permission grants are applied consistently across models that access the same resources.
Permissions are not applicable to the SYS and pg_catalog schemas. These metadata reporting schemas are always accessible regardless of the user. The SYSADMIN schema however may need permissions as applicable.
