Permissions for developers in AD+DTAP scenariosHow-To
In scenarios, where Active Directory authentication is activated, there is no out-of-the-box DV connect role available. Additionally, we would like a developer to have access to all things they create, without an admin having to grant them permissions. In a development/test/(acceptance/)production CI/CD scenario, a different role/person will be in charge to implement the changes on a 'higher' instance.In our example we will first allow the developer role everything, but reduce the permissions later on.In detail, we prevent the developers from creating/adding/removing data sources and users. We also prevent them from setting permissions for themselves.The developer-role must exist (coming from AD/LDAP) and be assigned to developers.EXEC SYSADMIN.setPermissions("role_name" => 'developer-role', "resourceName" => '*', "permissions" => 'CRUDEAL', "condition" => NULL, "isConstraint" => true, "mask" => NULL, "maskOrder" => NULL) ;EXEC SYSA