User management

Users in Management Center have roles that determine what permissions they have. For example, an admin user has access to all features, whereas a metrics-only user can only view metrics and can't see the data. How you create and manage users depends on the security provider you are using.

User roles

All users need one of the following roles:

Role	Permissions
Admin	Administrator privileges give users access to all features. Only admin users can update user passwords, create new users, or manage Enterprise licenses.
User	Users have read and write access to Management Center.
Read-Only User	Users cannot do anything that requires write permissions such as updating map configurations, running garbage collection, triggering a thread dump on a cluster member, or shutting down members or clusters.
Metrics-Only User	Users can only view metrics that are displayed in Management Center.

The following table shows details of the actions that can or cannot be performed for each user role.

Panel/Tab	Action	Admin	User	Read-Only	Metrics-Only
Storage → Map	Clear Data	✓	✓	𐄂	𐄂
	Reset Time	✓	✓	✓	✓
	Map Browser	✓	✓	✓	𐄂
	Map Config	✓	✓	𐄂	𐄂
Clients → View Preset	Add	✓	✓	𐄂	𐄂
	Edit	✓	✓	✓	✓
	Remove	✓	✓	✓	✓
Client Filtering	Add	✓	✓	𐄂	𐄂
	Edit	✓	✓	𐄂	𐄂
	Remove	✓	✓	𐄂	𐄂
	Enable/Disable	✓	✓	𐄂	𐄂
Members	Shutdown	✓	𐄂	𐄂	𐄂
	Run GC	✓	✓	𐄂	𐄂
	Thread Dump	✓	✓	𐄂	𐄂
Scripting	Execute Script	✓	✓	𐄂	𐄂
Healthcheck	Run Healthcheck	✓	𐄂	𐄂	𐄂
Administration	Cluster Shutdown	✓	𐄂	𐄂	𐄂
	Change Cluster State	✓	𐄂	𐄂	𐄂
	Rolling Upgrade	✓	𐄂	𐄂	𐄂
	Force Start	✓	𐄂	𐄂	𐄂
	Partial Start	✓	𐄂	𐄂	𐄂
	Hot Backup	✓	𐄂	𐄂	𐄂
	Update Config	✓	𐄂	𐄂	𐄂
Settings	Add/Remove Users	✓	𐄂	𐄂	𐄂
	Update License	✓	𐄂	𐄂	𐄂
Console	Execute Console Commands	✓	✓	𐄂	𐄂
WAN Replication	Change State	✓	✓	𐄂	𐄂
	WAN Sync	✓	✓	𐄂	𐄂
	WAN Sync Check	✓	✓	𐄂	𐄂
	Add Configuration	✓	✓	𐄂	𐄂
Streaming (SQL)	All	✓	✓	✓	𐄂
CP Subsystem	Promote	✓	✓	✓	𐄂
	Remove	✓	✓	✓	𐄂
	Restart	✓	✓	✓	𐄂
	View Metrics	✓	✓	✓	✓

important

The Scripting and Console features are an exception to the role-based permissions shown above. When these features are enabled on the cluster, any user who can access them has full, unrestricted access to the cluster, regardless of their assigned Management Center role. If granular access control is critical, consider leaving scripting and the console disabled.

New users

You can create new users and assign those users a role. The way in which you create new users depends on the security provider that you use to authenticate users in Management Center. For information, see Security Providers.

Authentication tokens

To use the REST API, users need an authentication token, unless you are an admin user and you are using dev mode.

The way in which you generate an authentication token depends on your chosen security provider. For information, see Clustered REST.