Manage the security in Semarchy xDM

Semarchy xDM uses role-based security and privilege grants for accessing its features as well as the data contained in the data location. Users accessing xDM are authenticated and their experience is customized depending on their privileges.

Platform and model security

There are two levels of security in xDM:

  • Platform-level security defines access to the features of the platform (e.g., access to the administrative features or the design-time capabilities). Platform-level security sets platform users' privileges (i.e., who is allowed to design models, monitor executions, manage security, etc.).

  • Model-level security defines security privileges to access and modify data in the data locations. Defining these privileges is a data governance decision that should be made as part of the broader data governance initiative. These privileges are included in the model and are explained in Secure the data hub.

Role-based security

Both levels of security are role-based:

  • Roles are declared in xDM, and privileges (platform-level or model-level) are granted to these roles in xDM.

  • Users logging in to xDM receive effective roles as part of their login process. Roles that match those defined in xDM give the user the associated privileges.

Two built-in roles, named semarchyConnect and semarchyAdmin, provide respectively baseline access and full access to the xDM features.

Security enforcement

When a user logs in to Semarchy xDM:

  1. The user enters their username and password in the xDM login window or authenticates with a single sign-on provider.

    For security purposes, xDM enforces a temporary block on the user’s IP address for 24 hours following five consecutive failed login attempts. This security measure applies solely to users connecting to xDM through the built-in identity provider (i.e., internal IDP).

    Platform administrators can either modify the maximum number of attempts by adjusting the value of the xdm.idm.maxloginattempts property, or deactivate this safeguard by setting the xdm.idm.maxloginattempts.enable property to false using the appropriate startup configuration method.

  1. The login process returns a list of effective roles in the user session’s security context.

  2. xDM matches these roles with those defined in its list of roles, to build the session’s security context, allowing:

    • Certain platform features, depending on the platform-level privileges granted to the corresponding roles.

    • Certain data access or modification capabilities, depending on the model-level privileges granted to the corresponding roles.

xDM enforces security at several layers in the application. In the user interface, insufficient privileges for a user translate to missing elements or disabled menus. In the REST API, insufficient privileges to perform an operation cause an error with the operation.

The roles declared in xDM are not only used for security purposes. They are also used as email aliases for email notifications and in workflow assignments.

Built-in roles

The following roles are built into the platform:

  • semarchyConnect: this role must be granted for a user to log in. It should be granted by default to all users connecting to xDM.

  • semarchyAdmin: this role has full access to all the features of the platform with no restrictions. semarchyAdmin is the only role that gives you access to identity management and API key configuration. It is also required for repository upgrade operations.

Be cautious when granting the semarchyAdmin role. This role defines a superuser who can create roles, grant privileges, and update the license information.