Managing user rights

Assigning user rights

In addition to creating and enabling a database, the create_inza_db.sh script also creates the following groups for users of the database:

dbname_inzaadmins: Users who need local admin rights for this database. This group grants permissions to the user as if they were the database owner.
dbname_inzadevelopers: Users who need to be able to register new AEs, UDXs, or stored procedures.
dbname_inzausers: Other users.

Each Netezza Performance Server Analytics user must be a member of one of these groups.

To manage access rights for the users of databases that are enabled for use with Netezza Performance Server Analytics, use the following scripts. Each script must be run once per combination of user and database. The specified user and database must exist before you can run the script.

To add a user to the dbname_inzaadmins group for the specified database:
```
$./create_inza_db_admin.sh dbname username
```
To add a user to the dbname_inzadevelopers group for the specified database:
```
$./create_inza_db_developer.sh dbname username
```
To add a user to the dbname_inzausers group for the specified database:
```
$./create_inza_db_user.sh dbname username
```

Note:

It is not necessary to run any of these scripts for the database administrator, that is, the user ADMIN.
Netezza Performance Server Analytics does not grant privileges to the PUBLIC group, nor does Netezza Performance Server Analytics require that users are members of the PUBLIC group. However, removing a user from the PUBLIC group might affect that user's ability to use other commands or other software products.

Assigning user rights on a subordinate node within a replication system

If the database you are assigning user rights for is on a subordinate node within a replication system, extra steps are necessary:

On the subordinate node, run one of the following commands for each combination of user and database:

/nz/export/ae/utilities/bin/create_inza_db_admin.sh dbname username
/nz/export/ae/utilities/bin/create_inza_db_developer.sh dbname username
/nz/export/ae/utilities/bin/create_inza_db_user.sh dbname username

Each command displays a list of SQL statements.

On the controller node, manually run the SQL statements that are displayed in the previous step.

Displaying access rights

Use the following command to display the access rights of a particular group:

nzsql \dpg groupname

Use the following command to display the access rights of a particular user:

nzsql \dp username

Revoking user rights

To revoke access rights for the users of databases that are enabled for use with Netezza Performance Server Analytics, use the following scripts. Each script must be run once per combination of user and database. The specified user and database must already exist before you can run the script.

To remove a user from the dbname_inzaadmins group for the specified database:
```
$./revoke_inza_db_admin.sh dbname username
```
To remove a user from the dbname_inzadevelopers group for the specified database:
```
$./revoke_inza_db_developer.sh dbname username
```
To remove a user from the dbname_inzausers group for the specified database:
```
$./revoke_inza_db_user.sh dbname username
```