Skip to content

App Settings Tutorial

Audience: Application Admins

Content Summary: This page details how to use the App Settings page to configure settings for Immuta for your organization.

  1. Click the App Settings icon in the left sidebar.

    App Settings

  2. Click the link in the App Settings panel to navigate to that section.

    App Settings Sidebar Default

Use Existing Identity Access Manager

See the identity manager pages for a tutorial to connect an Azure Active Directory, Okta, or OneLogin identity manager.

To configure Immuta to use all other existing IAMs,

  1. Click the Add IAM button.
  2. Complete the Display Name field and select your IAM type from the Identity Provider Type dropdown: LDAP/Active Directory, SAML, or OpenID.

    Config IAM

Once you have selected LDAP/Active Directory from the Identity Provider Type dropdown menu,

  1. Adjust Default Permissions granted to users by selecting from the list in this dropdown menu, and then complete the required fields in the Credentials and Options sections. Note: Either User Attribute OR User Search Filter is required, not both. Completing one of these fields disables the other.
  2. Opt to have Case-insensitive user names by clicking the checkbox.
  3. Opt to Enable Debug Logging or Enable SSL by clicking the checkboxes.
  4. In the Profile Schema section, map attributes in LDAP/Active Directory to automatically fill in a user's Immuta profile. Note: Fields that you specify in this schema will not be editable by users within Immuta.
  5. Opt to Link SQL Account.
  6. Opt to Enable scheduled LDAP Sync supprt for LDAP/Active Directory and Enable pagination for LDAP Sync. Once enabled, confirm the sync schedule written in Cron rule; the default is every hour. Confirm the LDAP page size for pagination; the default is 1,000.
  7. Opt to Sync groups from LDAP/Active Directory to Immuta. Once enabled, map attributes in LDAP/Active Directory to automatically pull information about the groups into Immuta.
  8. Opt to Sync attributes from LDAP/Active Directory to Immuta. Once enabled, add attribute mappings in the attribute schema. The desired attribute prefix should be mapped to the relevant schema URN.

    Attribute Schema

  9. Opt to enable External Groups and Attributes Endpoint, Make Default IAM, or Migrate Users from another IAM by selecting the checkbox.

  10. Then click the Test Connection button.
  11. Once the connection is successful, click the Test User Login button.
  12. Click the Test LDAP Sync button if scheduled sync has been enabled.

Once you have selected SAML from the Identity Provider Type dropdown menu,

  1. Take note of the ID and copy the SSO Callback URL to use as the ACS URL in your identity provider.

    SAML ID

  2. Adjust Default Permissions granted to users by selecting from the list in this dropdown menu, and then complete the required fields in the Client Options section.

  3. Opt to Enable SCIM support for SAML by clicking the checkbox, which will generate a SCIM API Key.
  4. In the Profile Schema section, map attributes in SAML to automatically fill in a user's Immuta profile. Note: Fields that you specify in this schema will not be editable by users within Immuta.
  5. Opt to Link SQL Account, Allow Identity Provider Initiated Single Sign On, Sync groups from SAML to Immuta, Sync attributes from SAML to Immuta, External Groups and Attributes Endpoint, or Migrate Users from another IAM by selecting the checkboxes, and then click the Test Connection button.
  6. Once the connection is successful, click the Test User Login button.

Once you have selected OpenID from the Identity Provider Type dropdown menu,

  1. Take note of the ID. You will need this value to reference the IAM in the callback URL in your identity provider with the format <base url>/bim/iam/<id>/user/authenticate/callback.
  2. Note the SSO Callback URL shown. Navigate out of Immuta and register the client application with the OpenID provider. If prompted for client application type, choose web.

    App Settings OpenID Redirect URL

  3. Adjust Default Permissions granted to users by selecting from the list in this dropdown menu.

  4. Back in Immuta, enter the Client ID, Client Secret, and Discover URL in the form field.
  5. Configure OpenID provider settings. There are two options:
    1. Set Discover URL to the /.well-known/openid-configuration URL provided by your OpenID provider.
    2. If you are unable to use the Discover URL option, you can fill out Authorization Endpoint, Issuer, Token Endpoint, JWKS Uri, and Supported ID Token Signing Algorithms.
  6. If necessary, add additional Scopes.
  7. Opt to Enable SCIM support for OpenID by clicking the checkbox, which will generate a SCIM API Key.
  8. In the Profile Schema section, map attributes in OpenID to automatically fill in a user's Immuta profile. Note: Fields that you specify in this schema will not be editable by users within Immuta.
  9. Opt to Allow Identity Provider Initiated Single Sign On or Migrate Users from another IAM by selecting the checkboxes.
  10. Click the Test Connection button.
  11. Once the connection is successful, click the Test User Login button.

Immuta Accounts

To set the default permissions granted to users when they log in to Immuta, click the Default Permissions dropdown menu, and then select permissions from this list.

Default Permissions

See the External Catalogs page.

Enable External Masking

To enable external masking,

  1. Navigate to the App Settings page and click External Masking in the left sidebar.
  2. Click Add Configuration and specify an external endpoint in the External URI field.

    External URI

  3. Click Configure, and then add at least one tag by selecting from the Search for tags dropdown menu. Note: Tag hierarchies are supported, so tagging a column as Sensitive.Customer would drive the policy if external masking was configured with the tag Sensitive).

    Search Tags

  4. Select Authentication Method and then complete the authentication fields (when applicable).

  5. Click Test Connection and then Save.

Add a Native Workspace

  1. Select Add Workspace.
  2. Use the dropdown menu to select the Workspace Type and refer to the corresponding tab below.

Databricks Cluster Configuration

Before creating a workspace, the cluster must send its configuration to Immuta; to do this, run a simple query on the cluster (i.e., show tables). Otherwise, an error message will occur when users attempt to create a workspace.

Databricks API Token Expiration

The Databricks API Token used for native workspace access must be non-expiring. Using a token that expires risks losing access to projects that are created using that configuration.

Use the dropdown menu to select the Schema and refer to the corresponding tab below.

Required AWS S3 Permissions

When configuring a native workspace using Databricks with S3, the following permissions need to be applied to arn:aws:s3:::immuta-workspace-bucket/workspace/base/path/* and arn:aws:s3:::immuta-workspace-bucket/workspace/base/path Note: Two of these values are found on the App Settings page; immuta-workspace-bucket is from the S3 Bucket field and workspace/base/path is from the Workspace Remote Path field:

  • s3:Get*
  • s3:Delete*
  • s3:Put*
  • s3:AbortMultipartUpload

Additionally, these permissions must be applied to arn:aws:s3:::immuta-workspace-bucket Note: One value is found on the App Settings page; immuta-workspace-bucket is from the S3 Bucket field:

  • s3:ListBucket
  • s3:ListBucketMultipartUploads
  • s3:GetBucketLocation
  1. Enter the Name.

  2. Click Add Workspace

    Databricks S3A Workspace

  3. Enter the Hostname.

  4. Opt to enter the Workspace ID (required with Azure Databricks).

  5. Enter the Databricks API Token.

  6. Use the dropdown menu to select the AWS Region.

  7. Enter the S3 Bucket.

  8. Opt to enter the S3 Bucket Prefix.

  9. Click Test Workspace Bucket.

  10. Once the credentials are successfully tested, click Save.

  1. Enter the Name.

  2. Click Add Workspace.

    Databricks ABFSS Workspace

  3. Enter the Hostname, Workspace ID, Account Name, Databricks API Token, and Storage Container.

  4. Enter the Workspace Base Directory.

  5. Click Test Workspace Directory.

  6. Once the credentials are successfully tested, click Save.

  1. Enter the Name.

  2. Click Add Workspace.

    Databricks ABFSS Workspace

  3. Enter the Hostname, Workspace ID, Account Name, and Databricks API Token.

  4. Use the dropdown menu to select the Google Cloud Region.

  5. Enter the GCS Bucket.

  6. Opt to enter the GCS Object Prefix.

  7. Click Test Workspace Directory.

  8. Once the credentials are successfully tested, click Save.

Add An Integration

  1. Select Add Native Integration.
  2. Use the dropdown menu to select the Integration Type and refer to the corresponding tab below.

To enable Native Azure Synapse Analytics, see Native Azure Synapse Analytics Installation.

To enable Databricks SQL, see the Native Databricks SQL Integration page.

To enable Redshift, see Redshift Installation.

To enable Snowflake, see the Snowflake integration guide.

To enable Starburst, see the Starburst integration guide.

Enable Email

Application Admins can configure the SMTP server that Immuta will use to send emails to users. If this server is not configured, users will only be able to view notifications in the Immuta console.

To configure the SMTP server,

  1. Complete the Host and Port fields for your SMTP server.
  2. Enter the username and password Immuta will use to log in to the server in the User and Password fields, respectively.
  3. Enter the email address that will send the emails in the From Email field.
  4. Opt to Enable TLS by clicking this checkbox, and then enter a test email address in the Test Email Address field.
  5. Finally, click Send Test Email.

    Config Email

Once SMTP is enabled in Immuta, any Immuta user can request access to notifications as emails, which will vary depending on the permissions that user has. For example, to receive email notifications about group membership changes, the receiving user will need the GOVERNANCE permission. Once a user requests access to receive emails, Immuta will compile notifications and distribute these compilations via email at 8-hour intervals.

Initialize Kerberos

To configure Immuta to protect data in a kerberized Hadoop cluster,

  1. Upload your Kerberos Configuration File, and then you can add modify the Kerberos configuration in the window pictured below.

    KDC Configuration

  2. Upload your Keytab File.

  3. Enter the principal Immuta will use to authenticate with your KDC in the Username field. Note: This must match a principal in the Keytab file.
  4. Adjust how often (in milliseconds) Immuta needs to re-authenticate with the KDC in the Ticket Refresh Interval field.
  5. Click Test Kerberos Initialization.

Generate System API Key

  1. Click the Generate Key button.
  2. Save this API key in a secure location.

Set Public URLs

You can set the URL users will use to access the Immuta Application.

  1. Complete the Public Immuta URL field.
  2. Opt to Enable SSL by clicking this checkbox.

    Public URLs

Enable Sensitive Data Discovery

To enable Sensitive Data Discovery and configure its settings, see the Sensitive Data Discovery section.

Allow Policy Exemptions

Click the Allow Policy Exemptions checkbox to allow users to specify who can bypass all policies on a data source.

Policy Exemptions

Default Subscription Merge Options

Immuta merges multiple Global Subscription policies that apply to a single data source; by default, users must meet all the conditions outlined in each policy to get access (i.e., the conditions of the policies are combined with AND). To change the default behavior to allow users to meet the condition of at least one policy that applies (i.e., the conditions of the policies are combined with OR),

  1. Click the Default Subscription Merge Options text in the left pane.
  2. Select the Default "allow shared policy responsibility" to be checked checkbox.

    Default Subscription Merge

  3. Click Save.

Note: Even with this setting enabled, Governors can opt to have their Global Subscription policies combined with AND during policy creation.

Configure Governor and Admin Settings

These options allow you to restrict the power individual users with the GOVERNANCE and USER_ADMIN permissions have in Immuta. Click the checkboxes to enable or disable these options.

Gov and Admin Settings

Create Custom Permissions

You can create custom permissions that can then be assigned to users and leveraged when building subscription policies. Note: You cannot configure actions users can take within the console when creating a custom permission, nor can the actions associated with existing permissions in Immuta be altered.

To add a custom permission, click the Add Permission button, and then name the permission in the Enter Permission field.

Custom Permissions

Create Custom Data Source Access Requests

To create a custom questionnaire that all users must complete when requesting access to a data source, fill in the following fields:

  1. Opt for the questionnaire to be required.
  2. Key: Any unique value that identifies the question.
  3. Header: The text that will display on reports.
  4. Label: The text that will display in the questionnaire for the user.

Data Source Access Request Questionnaire

Create Custom Login Message

To create a custom message for the login page of Immuta, enter text in the Enter Login Message box. Note: The message can be formatted in markdown.

Opt to adjust the Message Text Color and Message Background Color by clicking in these dropdown boxes.

Login Message

Prevent Automatic Table Statistics

Without Fingerprints Some Policies Will Be Unavailable.

These policies will be unavailable until a data owner manually generates a fingerprint:

  • Masking with format preserving masking
  • Masking with K-Anonymization
  • Masking using randomized response

To disable the automatic collection of statistics with a particular tag,

  1. Use the Select Tags dropdown to select the tag(s).

    Prevent Stats Tag

  2. Click Save.

Advanced Settings

Preview Features

If you enable any Preview features, please provide feedback on how you would like these features to evolve.

Policy Adjustments

  1. Click Advanced Settings in the left panel, and scroll to the Preview Features section.
  2. Check the Enable Policy Adjustments checkbox.

    Enable Policy

  3. Click Save.

Health Expert Determination

  1. Click Advanced Settings in the left panel, and scroll to the Preview Features section.

  2. Check the Enable Policy Adjustments checkbox.

  3. Check the Enable Health Expert Determination checkbox.

    Enable HED

  4. Click Save.

dbt Cloud

  1. Click Advanced Settings in the left panel, and scroll to the Preview Features section.
  2. Check the Enable dbt cloud integration checkbox.

    Enable dbt Cloud

  3. Click Save.

Complex Data Types

  1. Click Advanced Settings in the left panel, and scroll to the Preview Features section.
  2. Check the Allow Complex Data Types checkbox.

    Allow Complex Data Types

  3. Click Save.

Enhanced Subscription Policy Variables

For instructions on enabling this feature, navigate to the Global Subscription Policies Advanced DSL Tutorial.

Administer Features

The Query Engine grants Immuta user accounts proxied data query access to Immuta data sources through the Immuta API and the Query Editor in the Immuta UI.

Application Administrators can turn off the Query Engine to ensure data does not leave a data localization zone when authorized users access the Immuta Application outside data jurisdiction.

To disable this feature,

  1. Click Advanced Settings in the left panel, and scroll to the Administer Features section.
  2. Select the Disable radio button and click Save.

    Disable Query Engine

  3. Click Confirm to deploy your changes.

Deploy Configuration Changes

When you are ready to finalize your configuration changes, click the Save button at the bottom of the left panel, and then click Confirm to deploy your changes.

Config Builder Save