- PrivaceraCloud Release 7.4
- Enhancements and updates in PrivaceraCloud release 7.4
- Known Issues in PrivaceraCloud 7.4
- PrivaceraCloud User Guide
- Overview of PrivaceraCloud
- Connect applications with the setup wizard
- Connect applications
- About applications
- Connect Azure Data Lake Storage Gen 2 (ADLS) to PrivaceraCloud
- Connect Amazon Textract to PrivaceraCloud
- Athena
- Privacera Discovery with Cassandra
- Connect Databricks to PrivaceraCloud
- Databricks SQL
- Databricks SQL Overview and Configuration
- Planning and general process
- Prerequisites
- Databricks SQL with Privacera Hive
- Connect Databricks SQL application
- Grant Databricks SQL permissions to PrivaceraCloud users
- Define a resource policy
- Test the policy
- Databricks SQL PolicySync fields
- Configuring column-level access control
- View-based masking functions and row-level filtering
- Create an endpoint in Databricks SQL
- Databricks SQL Fields
- Databricks SQL Hive Service Definition
- Databricks SQL Masking Functions
- Databricks SQL Encryption
- Use a custom policy repository with Databricks
- Connect Databricks SQL to Hive policy repository on PrivaceraCloud
- Databricks SQL Overview and Configuration
- Connect Databricks Unity Catalog to PrivaceraCloud
- Connect S3 to PrivaceraCloud
- Prerequisites in AWS console
- Connect S3 application to PrivaceraCloud
- Enable Privacera Access Management for S3
- Enable Data Discovery for S3
- S3 AWS Commands - Ranger Permission Mapping
- S3
- AWS Access with IAM
- Access AWS S3 buckets from multiple AWS accounts
- Add UserInfo in S3 Requests sent via Dataserver
- Control access to S3 buckets with AWS Lambda function on PrivaceraCloud
- Dremio Plugin
- DynamoDB
- Connect Elastic MapReduce from Amazon application to PrivaceraCloud
- Connect EMR application
- EMR Spark access control types
- PrivaceraCloud configuration
- AWS IAM roles using CloudFormation setup
- Create a security configuration
- Create EMR cluster
- How to configure multiple JSON Web Tokens (JWTs) for EMR
- EMR Native Ranger Integration with PrivaceraCloud
- Connect EMRFS S3 to PrivaceraCloud
- Files
- GBQ
- Google Cloud Storage
- Connect Glue to PrivaceraCloud
- Google BigQuery for PolicySync
- Connect Kinesis to PrivaceraCloud
- Connect Lambda to PrivaceraCloud
- Microsoft SQL Server
- MySQL for Discovery
- Open Source Apache Spark
- Oracle for Discovery
- PostgreSQL
- Connect Power BI to PrivaceraCloud
- Presto
- Redshift
- Snowflake
- Starburst Enterprise with PrivaceraCloud
- Starburst Enterprise Presto
- Trino
- Connect users
- Data access Users, Groups, and Roles
- UserSync
- Portal user LDAP/AD
- Datasource
- Okta Setup for SAML-SSO
- Azure AD setup
- SCIM Server User-Provisioning
- User Management
- Identity
- Access Manager
- Access Manager
- Resource Policies
- Tag Policies
- Scheme Policies
- Service Explorer
- Reports
- Audit
- About data access users, groups, and roles resource policies
- Security zones
- Discovery
- Classifications via random sampling
- Privacera Discovery scan targets
- Propagate Privacera Discovery Tags to Ranger
- Enable offline scanning on Azure Data Lake Storage Gen 2 (ADLS)
- Enable Real-time Scanning of S3 Buckets
- Enable Real-time Scanning on Azure Data Lake Storage Gen 2 (ADLS)
- Enable Discovery Realtime Scanning Using IAM Role
- Encryption
- Overview of Privacera Encryption
- Encryption schemes
- Presentation schemes
- Masking schemes
- Create scheme policies
- Privacera-supplied encryption schemes for the Privacera API
- Privacera-supplied encryption schemes for the Bouncy Castle API
- API date input formats
- Deprecated encryption formats, algorithms, and scopes
- Privacera Encryption REST API
- PEG API endpoint
- PEG REST API encryption endpoints
- Prerequisites
- Common PEG REST API fields
- Construct the datalist for the /protect endpoint
- Deconstruct the response from the /unprotect endpoint
- Example data transformation with the /unprotect endpoint and presentation scheme
- Example PEG API endpoints
- Make encryption API calls on behalf of another user
- Privacera Encryption UDF for masking in Databricks on PrivaceraCloud
- Privacera Encryption UDFs for Trino on PrivaceraCloud
- Syntax of Privacera Encryption UDFs for Trino
- Prerequisites for installing Privacera Crypto plug-in for Trino
- Download and install Privacera Crypto jar
- Set variables in Trino etc/crypto.properties
- Restart Trino to register the Privacera encryption and masking UDFs for Trino
- Example queries to verify Privacera-supplied UDFs
- Privacera Encryption UDF for masking in Trino on PrivaceraCloud
- Encryption UDFs for Apache Spark on PrivaceraCloud
- Launch Pad
- Settings
- Dashboard
- Usage statistics
- Operational status of PrivaceraCloud and RSS feed
- How to Get Support
- Coordinated Vulnerability Disclosure (CVD) Program of Privacera
- Shared Security Model
- PrivaceraCloud Previews
- Preview: File Explorer for S3
- Preview: File Explorer for Azure
- Preview: File Explorer for GCS
- Preview: Scan Generic Records with NER Model
- Preview: Scan Electronic Health Records with NER Model
- Preview: OneLogin setup for SAML-SSO
- Preview: Azure Active Directory SCIM Server UserSync
- Preview: OneLogin UserSync
- Preview: PingFederate UserSync
- Quickstart for Databricks Unity Catalog on PrivaceraCloud
- What do I need to do in my Databricks Workspace?
- Where is the sample dataset in my Databricks Workspace?
- What should I do in the PrivaceraCloud web portal?
- Access use-case - How do I give a user access to a table or restrict from running a SQL select query?
- Access use-case - How do I restrict a user from seeing contents of a column in the result of a SQL select query?
- Column masking use-case - How do I restrict a user from seeing contents of a column by masking the values in the result of a SQL select query?
- Access use-case - How do I disallow a user from seeing certain rows of a table?
- PrivaceraCloud documentation changelog
Enable Single Sign On on PrivaceraCloud
PrivaceraCloud can be configured for Single Sign On (SSO) with a SAML connection. To activate SSO, you must connect an external IdPs (Okta and Azure) via SAML.
These are the general steps for enabling SSO:
Connect an IdP to PrivaceraCloud.
On the PrivaceraCloud UI, enable SSO login. For more information, see Enable only SSO login.
Effects of enabling SSO
When SSO is enabled, users can log in to PrivaceraCloud using only their SSO credentials. When enabled, you can redirect to your organization's authentication system, such as Okta or Azure.
Note
When SSO login is enabled, an account administrator can also login via SSO.
Connect IdP (Okta and Azure AD)
These steps are to connect an IdP to your PrivaceraCloud account.
Prerequisites
Establish an Okta or Azure AD account and obtain key information before configuring Privacera SAML.
For more information about Okta setup, see Okta Identity Provider Setup to obtain required SAML and metadata information.
For more information about Azure AD setup, See Azure AD setup to obtain required SAML and metadata information.
Once that information is available return to this section to complete the setup.
Steps to connect IdPs
On the left navigation, go to Settings > Identity.
Click the Single Sign On section.
You can see the single Sign On section with the fields.
Using the IMPORT PROPERTIES button, you can browse and import application properties.
Using the EXPORT PROPERTIES button, you can save the application properties.
Enter the Application Properties details in the given fields, see tables below.
Click Save.
The following table shows the mapping of the fields in PrivaceraCloud with the fields of the SAML app in the Okta account:
PrivaceraCloud Fields | SAML App Fields in Okta | Values | Description |
---|---|---|---|
Entity Id | Audience URI (SP Entity ID) | privacera_portal | The value of the Entity id is the same as that which is used to configure Okta or Azure. |
Identity Provider Url | Embed Link | URL | Use Embed link from General > App Embed Link section in the Okta account. |
Identify Provider Metadata | Identity Provider Metadata | XML file | Upload the XML metadata that you generated and saved in the Okta configuration. For more information, see IdP provider metadata |
UserName Attribute | UserID | UserID | Use only the field name from Okta i.e., UserID |
Email Attribute | Use only the field name from Okta i.e., Email | ||
FirstName Attribute | FirstName | FirstName | Use only the field name from Okta i.e., FirstName (Optional) |
LastName Attribute | LastName | LastName | Use only the field name from Okta i.e., LastName (Optional) |
The following table shows the mapping of the fields in PrivaceraCloud with the fields of the SAML app in the Azure AD account:
PrivaceraCloud Fields | SAML App Fields in Azure AD | Values | Description |
---|---|---|---|
Entity Id | Entity ID | privacera-portal | The value of the entity id is the same as that which is used to configure Okta or Azure. |
Identity Provider Url | Azure AD Identifier | URL | Use the copied Azure AD Identifier URL from Azure AD portal. |
Identify Provider Metadata | Federation Metadata XML | XML file | Upload XML which you have downloaded from the Azure portal. |
UserName Attribute | name | user.userprincipalname | It must be same as the Azure AD user used in the Attributes and Claims section. |
FirstName Attribute | givenname | user.givenname | It must be same as the Azure AD givenname used in the Attributes and Claims section. |
LastName Attribute | surname | user.surname | It must be same as the Azure AD user surname used in the Attributes and Claims section. |
Email Attribute | emailaddress or name | user.email | It must be same as the Azure AD user email address used in the Attributes and Claims section. If the name and email address in your Azure account are the same, you can use the name instead of the email address. |
Enable only SSO login
In this topic, you will learn how to enable SSO login using the toggle button in the PrivaceraCloud portal. When enabled, users will no longer be able to sign in with their credentials.
Prerequisites
You need to have connected your IdP via SAML to your PrivaceraCloud account.
As an account administrator, you need to login to PrivaceraCloud using your SSO credentials.
Steps to enable SSO login
As an account administrator, login to PrivaceraCloud using your SSO username and password.
Navigate to Settings > Account.> AUTHENTICATION SETTINGS.
The system displays informative messages if the prerequisites to enable SSO have not been met:
SAML is not configured. See ???.
Unauthorized
If all prerequisites have been met, no messages are displayed.
Click the Enable only SSO login (Disable login with Email and Password) toggle button.
SSO URL without login screen
By using the SSO URL given below, you can directly login into PrivaceraCloud through SSO.
Substitute the value of the <account_ID>
.
https://privaceracloud.com/sso?acountId=<account_ID>