Cluster Configurations

This section includes several important components, including API audit logging, branding, configuring SSO connections, and managing local users. The API audit logging section provides instructions on how to set up and customize logging for API requests, allowing administrators to track usage and identify potential issues. The branding section allows users to customize the appearance of the product with logos, favicons, and other design elements. The SSO section provides instructions for configuring single sign-on capabilities, enabling users to log in to multiple systems with a single set of credentials. Finally, the users section provides instructions on how to add, edit, and remove user accounts, as well as set permissions and roles for each user. Together, these sections help organizations personalize and manage DataBee to suit their needs.

Navigate to the top right corner of DataBee portal and click on the configuration icon. A drop-down menu appears with System and Access management buttons.

System Configurations

This section provides instructions on how to configure the API audit logs output stream and customize the brand image to meet the user's specific needs and preferences.

Audit Logging

API audit logging keeps a record of all activities and transactions that happen through the API. It helps monitor API usage, detect security issues, and troubleshoot problems with the API. It involves recording data like timestamps, HTTP methods, endpoints, and payloads. It then sends the logs to the Kubernetes cluster log manager.

Navigate to the top right corner of the portal and click on the configuration icon. A drop-down menu will appear with the System and Access Management buttons. Click on the System button to configure API audit logging and branding for your portal. You can click on the Audit Logging button which takes you to the "audit logging" page.

You can configure the verbosity of the API output stream for auditing purposes, by adjusting the level of detail or amount of information to be recorded in the log files. The output stream determines where the response of HTTP GET requests made to the API is directed. HTTP POST, PUT and DELETE requests are always logged to stderr. You can select one of the following options for HTTP GET requests:

none- By default, the HTTP GET request output stream is set to "none", which means that the HTTP GET request and response data will not be logged or directed to any output stream. This option can be useful if you do not need to monitor or audit GET activity.

stderr- When you choose the stderr option for the HTTP GET request output stream, the API's response data will be logged to the standard error stream. This will include HTTP GET audit records with all other standard error and audit log data generated by the API.

stdout- When you choose the stdout option for the HTTP GET request output stream, the API's HTTP GET response data will be logged in real-time to the container's stdout whenever the client makes a request. This will mix HTTP GET audit records with all other standard output generated by the API.

After choosing your preferred option, click on the Submit button to save it. A pop-up notification that says "Configuration updated" appears on the screen.

Branding

The branding configuration allows you to customize the visual elements of the system such as images, links, manuals, etc. to align with the company's branding guidelines. By configuring these settings, users can create a more personalized experience for their users and reinforce brand recognition.

Navigate to the top right corner of the portal and click on the configuration icon. Click on the System button from the drop-down menu that appears. Click on the Branding button to customize the branding and appearance of the portal. Fill in the details such as the company name, product name, URL of the license agreement, company website, and online user manual. You can upload the user manual document, favicon, and logo image. Click on the Select button to browse for the image or document from your computer. Once you have selected the file, click on the "Open" button to complete the upload process. Click on the checkbox if you prefer to hide the product name and only display the logo. After entering all the details, click on the Submit button to save the preferences. On successful submission, a pop-up notification that says "Branding information has been successfully updated" appears on the screen. The branding configuration changes apply to both the cluster management application and DataBee tenant application.

Access Management

Access management involves establishing procedures for creating and managing user accounts, defining access permissions based on job roles or responsibilities, and monitoring user activity to ensure compliance with security policies. This includes managing local user access, where user accounts are created and permissions are assigned based on job roles or responsibilities. It also includes implementing Role-Based Access Control (RBAC) which assigns permissions based on predefined roles, simplifying the management of user access. Additionally, Single Sign-On (SSO) allows enterprise users to use a single set of credentials to access multiple systems. By implementing access management practices such as these, organizations can ensure that only authorized individuals have access to sensitive information.

Single Sign-On (SSO)

DataBee user accounts can be administered in two ways: local or domain. Security best practice is for customers to use domain accounts and maintain a single local account in case of emergency (some customers may elect to have no local accounts and rely on DataBee Support for enabling emergency access).

Domain account management, also known as Single Sign-On (SSO), allows customers to leverage an identity access management (IAM) system, such as Azure ActiveDirectory, to store and manage user accounts centrally for an entire organization. User accounts are created and credentials managed through the IAM solution instead of DataBee. This includes the use of multifactor authentication (MFA) which will be orchestrated by the tenant's IAM solution. Domain users are placed into one or more groups and those groups are assigned to DataBee roles (see DataBee Cluster Roles). Interactions with the IAM system are performed over the Security Assertion Markup Language (SAML) protocol. To enable the SAML integration configure SSO in the Access Management configuration section of DataBee.

Navigate to the top right corner of DataBee portal and click on the configuration icon. Select Access Management from the dropdown menu that appears, and then click on Single Sign-On (SSO). The "Single Sign-On (SSO)" page will be displayed where you can view the SSO connections configured.

Click on the Add Connection button to add a new SSO connection. In the Add Connection dialog box that appears, enter the SSO connection details. In the 'Details' section, in the 'Name' field, enter a name to identify this SSO connection, and in the 'Button Text' field enter the text to be displayed in the login button. Under the 'Role Mapping' section, select the 'Cluster Administrator Group' and 'Support Group' from the drop-down list. Under the 'Identity Management' section, select the Identity Provider from the dropdown menu. Next, upload the required SAML IDP metadata file by clicking on the 'Attach File' button to add the file from your system. Under the 'Attribute Mapping' section, you may map the email, family_name, given_name, middle_name, and preferred_username to your domain's name for these fields as defined in your SAML IDP metadata file. Click on the 'Add Attribute' button to browse and add attributes to the mapping. After entering all the details, click on the Establish Connection button to initiate the SSO connection.

Click on the Manage button under the ACTIONS column, if you prefer to update the details provided for the SSO connection. At the top right corner of the "Update Connection" page, click on View Metadata to view the metadata fields. Click on Update Connection to save the changes made.

Users

Navigate to the top right corner of the DataBee portal and click on the configuration icon. Select Access Management from the dropdown menu that appears. The "Access Management" configuration page will be displayed. Select the Users tab. A table with the following columns will be shown:

ID: the unique identifier for each user account.

FULL NAME: the name of the user associated with the account.

USERNAME: the username used to log in to the account.

LAST LOGIN: the date and time the user last logged in to the account.

CREATED: the date and time the user account was created.

ROLE: the user role assigned to the account such as Cluster Administrator or Support engineer.

TYPE: the type of account for e.g., Local.

STATUS: the current state of the account, whether it is Active or Inactive. Inactive accounts are not permitted to log into DataBee but information related or linked to those accounts is retained by the system.

ACTIONS: the available actions for each user account, which includes Edit, Reset Password, and Enable or Disable the account.

Just below the column headings, you will see a filter option. Here, you can type in the keyword you want to filter by, and it shows the user accounts that matches your filter keyword.

Note that only users with administrative privileges can manage user accounts in DataBee.

To create a new user account, click on the Create User Account button located below the table. This will take you to the "User Details" page. Fill in the user details such as the First Name, Last Name, Email, Username, Password and select the user role from the Role dropdown menu. Click on the Submit button to create the new user account.

To edit an existing user account, click on Edit located in the 'ACTIONS' column of the table. This will take you to the "User Details" page where you can make the necessary changes and click on the Submit button.

Administrators can also reset passwords, enable or disable user accounts. You can click on Enable or Disable in the 'ACTIONS' column, to enable or disable user accounts. Click on Reset Password located in the 'ACTIONS' column of the table. A confirmation dialog box appears to ensure that you really want to reset the password. Click on the OK button to proceed.

Role-based Access Controls

Role-based access controls (RBAC) selectively allow users to use DataBee features based on what functions they perform for the enterprise. This allows enterprises to implement a policy of least privilege access. DataBee cluster has two defined roles (Cluster Administrator and Support) that users can be mapped into. For enterprises using Single Sign-On (i.e., domain-managed user identities) the DataBee UI allows for them to map domain groups to DataBee roles. If a domain user is a member of multiple mapped groups, that user will be provided the highest level of permission allowed for any of the groups for which he/she is a member.

DataBee Cluster Roles

These roles are only to be used by Comcast employees.

• Support: Responsible for working with customers to identify technical issues with the product, communicating those to the engineering team, and working to roll out solutions to the customer.
• Cluster Administrator: Responsible for the administration of the DataBee infrastructure for a particular customer.

RBAC Matrix

For each feature a role can have the following permissions:

• "r" for read (i.e., allow GET)
• "w" for write (i.e., allow POST, PUT, and DELETE)
• "r/w" both "r" and "w"

Cluster Administration Application

Cluster Web Application Permissions