Skip to main content

Privacera Documentation

Connect Collibra to PrivaceraCloud

This topic describes how to connect Collibra to PrivaceraCloud.

Prerequisites

Ensure that the following prerequisites are met:

  • You must have an existing Collibra account and login credentials.

  • PrivaceraCloud portal admin user access.

Setup Collibra connector on PrivaceraCloud

  1. Go to Settings > Applications.

  2. On the Applications screen, select Collibra.

  3. Enter the application Name and Description.

  4. Click SAVE.

  5. Click the toggle button Enabled_Toggle.png to enable Access Management for the application.

  6. Under the BASIC tab, enter values in the following fields:

    Important

    If you have configured the Privacera service repository and Privacera ranger service repository field value to privacera_snowflake, you need to add the following property to the custom properties in the ADVANCED tab to configure the database name to be managed:

    collibra.manage.database.name=<DATABASE_NAME>

    Note

    If you have a preexisting .JSON file containing application properties, then you can directly go to step 8.

    Table 8. Basic fields

    Field name

    Type

    Default

    Required

    Description

    Collibra URL

    string

    Yes

    Specifies the URL of the Collibra environment

    Use the following format for the Collibra string:

    https://companyname.collibra.com/

    Collibra username

    string

    Yes

    Specifies the Collibra username to use.

    Collibra user password

    string

    Yes

    Specifies the Collibra user password to use.

    Privacera service repository

    string

    Yes

    Specifies the name of the Privacera service repository to use to push policy info into Collibra.

    Privacera ranger service repository

    string

    Yes

    Specifies the name of the Privacera ranger service repository to use to push policy info into Collibra.



  7. Under the ADVANCED tab, you can add following properties.

    Table 9. Advanced fields

    Field name

    Type

    Default

    Required

    Description

    Databases to set access control policies

    String

    No

    Specifies a comma-separated list of database names for which PolicySync manages access control. If unset, access control is managed for all databases. If specified, use the following format. You can use wildcards.

    An example list of databases might resemble the following: testdb1,testdb2,sales db*.

    Note

    Values in this field are case-sensitive.

    If specified, Databases to ignore while setting access control policies takes precedence over this setting.

    Databases to ignore while setting access control policies

    string

    No

    Specifies a comma-separated list of database names that PolicySync does not provide access control for. You can specify wildcards.

    If not specified, all databases are subject to access control.

    For example:

    testdb1,testdb2,sales db*

    Note

    Values in this field are case-sensitive.

    Manage users from portal

    boolean

    true

    No

    Specifies whether PolicySync maintains user membership in roles in the Collibra server data source.

    Manage groups from portal

    boolean

    true

    No

    Specifies whether PolicySync creates groups from Privacera in the Collibra Server data source.

    Manage roles from portal

    boolean

    true

    No

    Specifies whether PolicySync creates roles from Privacera in the Collibra Server data source.

    Users to set access control policies

    string

    No

    Specifies a comma-separated list of user names for which PolicySync manages access control. You can use wildcards.

    If not specified, PolicySync manages access control for all users

    An example user list might resemble the following: user1,user2,dev_user*.

    Note

    Values in this field are case-sensitive.

    If specified, Users to be ignored by access control policies takes precedence over this setting.

    Groups be ignored by access control policies

    string

    No

    Specifies a comma-separated list of group names for which PolicySync manages access control.

    If unset, access control is managed for all groups.

    If specified, use the following format. You can use wildcards.

    An example user list might resemble the following: user1,user2,dev_user*.

    Note

    Values in this field are case-sensitive.

    If specified, Groups be ignored by access control policies takes precedence over this setting.

    Roles be ignored by access control policies

    string

    No

    Specifies a comma-separated list of role names for which PolicySync manages access control.

    If unset, access control is managed for all roles.

    If specified, use the following format. You can use wildcards.

    An example user list might resemble the following: user1,user2,dev_user*.

    Note

    Values in this field are case-sensitive.

    If specified, Roles be ignored by access control policies takes precedence over this setting.

    Set access control policies only on the users from managed groups

    boolean

    false

    No

    Specifies whether to manage only the users that are members of groups specified by Groups to set access control policies.

    Set access control policies only on the users/groups from managed roles

    boolean

    false

    No

    Specifies whether to manage only users that are members of the roles specified by Roles to set access control policies.

    Collibra service repository attribute

    string

    Privacera Service Repo

    No

    Specifies the Collibra service repository that PolicySync will use when pushing policies.

    Collibra row filter attribute

    string

    Restrict Rows (Privacera)

    No

    Specifies the attribute in Collibra row filter that PolicySync will use when pushing policies.

    Collibra column masking attribute

    string

    Column Masking (Privacera)

    No

    Specifies the attribute in Collibra for masking policies that PolicySync will use when pushing policies to Collibra.

    Collibra community name

    string

    Enterprise

    No

    Specifies the community in Collibra that PolicySync will use to create users/groups/roles.

    User asset type

    string

    Users (Privacera)

    No

    Specifies the asset type for users that PolicySync will use to create users.

    Group asset type

    string

    Groups (Privacera)

    No

    Specifies the asset type for group that PolicySync will use to create groups.

    Role asset type

    string

    Roles (Privacera)

    No

    Specifies the asset type for roles that PolicySync will use to create roles.

    Collibra user domain

    string

    Users

    No

    Specifies the domain name that PolicySync will use to create users.

    Collibra group domain

    string

    Groups

    No

    Specifies the domain name that PolicySync will use to create groups.

    Collibra role domain

    string

    Roles

    No

    Specifies the domain name that PolicySync will use to create roles.



  8. Click IMPORT PROPERTIES to import properties from preexisting .JSON file.

  9. Click SAVE.

Limitations

The following are the limitations with Collibra connector:

Note

The Privacera team is currently working on addressing the following known limitations with the Collibra connector. In case you are facing any of these, contact Privacera customers support.

  • The Collibra connector relies on existing Attribute and Relation types within the Collibra environment. It does not create new types.

  • The Collibra connector supports policy synchronization exclusively for Hive and Snowflake repositories.

  • Tag synchronization transfers Tag attributes from Collibra to Ranger only.

  • The removal of access policies after it has been disabled is not functioning as intended.

  • The process of adding tags from Ranger to Collibra is not performing as expected.

  • Masking use cases may not work as expected for both Hive and Snowflake repositories.

  • The Collibra connector can manage only a single database at a time for both Hive and Snowflake repositories.