# Permissions for developers in AD+DTAP scenarios

**URL:** <https://community.cdata.com/t/permissions-for-developers-in-ad-dtap-scenarios/763>\
**Category:** CData Virtuality \[Archived\]\
**Tags:** article, cdata-virtuality\
**Created:** [June 10, 2024, 4:13pm UTC](https://community.cdata.com/t/permissions-for-developers-in-ad-dtap-scenarios/763 "2024-06-10T16:13:37Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![anonymous](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@anonymous](https://community.cdata.com/u/anonymous)\
**Post date:** [June 10, 2024, 4:13pm UTC](https://community.cdata.com/t/permissions-for-developers-in-ad-dtap-scenarios/763/1 "2024-06-10T16:13:37Z")

</div>

In scenarios, where Active Directory authentication is activated, there is no out-of-the-box DV connect role available. Additionally, we would like a developer to have access to all things they create, without an admin having to grant them permissions. In a development/test/(acceptance/)production CI/CD scenario, a different role/person will be in charge to implement the changes on a ‘higher’ instance.

In our example we will first allow the developer role everything, but reduce the permissions later on.

In detail, we prevent the developers from creating/adding/removing data sources and users. We also prevent them from setting permissions for themselves.

The developer-role must exist (coming from AD/LDAP) and be assigned to developers.

```auto
EXEC SYSADMIN.setPermissions("role_name" => 'developer-role', "resourceName" => '*', "permissions" => 'CRUDEAL', "condition" => NULL, "isConstraint" => true, "mask" => NULL, "maskOrder" => NULL) ;EXEC SYSADMIN.setPermissions("role_name" => 'developer-role', "resourceName" => 'SYSADMIN.createDataSource', "permissions" => '', "condition" => NULL, "isConstraint" => false, "mask" => NULL, "maskOrder" => NULL) ;EXEC SYSADMIN.setPermissions("role_name" => 'developer-role', "resourceName" => 'SYSADMIN.createConnection', "permissions" => '', "condition" => NULL, "isConstraint" => false, "mask" => NULL, "maskOrder" => NULL) ;EXEC SYSADMIN.setPermissions("role_name" => 'developer-role', "resourceName" => 'SYSADMIN.addRole', "permissions" => '', "condition" => NULL, "isConstraint" => false, "mask" => NULL, "maskOrder" => NULL) ;EXEC SYSADMIN.setPermissions("role_name" => 'developer-role', "resourceName" => 'SYSADMIN.addUser', "permissions" => '', "condition" => NULL, "isConstraint" => false, "mask" => NULL, "maskOrder" => NULL) ;EXEC SYSADMIN.setPermissions("role_name" => 'developer-role', "resourceName" => 'SYSADMIN.addUserRole', "permissions" => '', "condition" => NULL, "isConstraint" => false, "mask" => NULL, "maskOrder" => NULL) ;EXEC SYSADMIN.setPermissions("role_name" => 'developer-role', "resourceName" => 'SYSADMIN.deleteRole', "permissions" => '', "condition" => NULL, "isConstraint" => false, "mask" => NULL, "maskOrder" => NULL) ;EXEC SYSADMIN.setPermissions("role_name" => 'developer-role', "resourceName" => 'SYSADMIN.deleteUser', "permissions" => '', "condition" => NULL, "isConstraint" => false, "mask" => NULL, "maskOrder" => NULL) ;EXEC SYSADMIN.setPermissions("role_name" => 'developer-role', "resourceName" => 'SYSADMIN.deleteUserRole', "permissions" => '', "condition" => NULL, "isConstraint" => false, "mask" => NULL, "maskOrder" => NULL) ;EXEC SYSADMIN.setPermissions("role_name" => 'developer-role', "resourceName" => 'SYSADMIN.dropConnection', "permissions" => '', "condition" => NULL, "isConstraint" => false, "mask" => NULL, "maskOrder" => NULL) ;EXEC SYSADMIN.setPermissions("role_name" => 'developer-role', "resourceName" => 'SYSADMIN.dropDatasource', "permissions" => '', "condition" => NULL, "isConstraint" => false, "mask" => NULL, "maskOrder" => NULL) ;EXEC SYSADMIN.setPermissions("role_name" => 'developer-role', "resourceName" => 'SYSADMIN.execExternalProcess', "permissions" => '', "condition" => NULL, "isConstraint" => false, "mask" => NULL, "maskOrder" => NULL) ;EXEC SYSADMIN.setPermissions("role_name" => 'developer-role', "resourceName" => 'SYSADMIN.executeCli', "permissions" => '', "condition" => NULL, "isConstraint" => false, "mask" => NULL, "maskOrder" => NULL) ;EXEC SYSADMIN.setPermissions("role_name" => 'developer-role', "resourceName" => 'SYSADMIN.importConnection', "permissions" => '', "condition" => NULL, "isConstraint" => false, "mask" => NULL, "maskOrder" => NULL) ;EXEC SYSADMIN.setPermissions("role_name" => 'developer-role', "resourceName" => 'SYSADMIN.importDataSource', "permissions" => '', "condition" => NULL, "isConstraint" => false, "mask" => NULL, "maskOrder" => NULL) ;EXEC SYSADMIN.setPermissions("role_name" => 'developer-role', "resourceName" => 'SYSADMIN.importUser', "permissions" => '', "condition" => NULL, "isConstraint" => false, "mask" => NULL, "maskOrder" => NULL) ;EXEC SYSADMIN.setPermissions("role_name" => 'developer-role', "resourceName" => 'SYSADMIN.removeConnection', "permissions" => '', "condition" => NULL, "isConstraint" => false, "mask" => NULL, "maskOrder" => NULL) ;EXEC SYSADMIN.setPermissions("role_name" => 'developer-role', "resourceName" => 'SYSADMIN.removeDataSource', "permissions" => '', "condition" => NULL, "isConstraint" => false, "mask" => NULL, "maskOrder" => NULL) ;EXEC SYSADMIN.setPermissions("role_name" => 'developer-role', "resourceName" => 'SYSADMIN.setPermissions', "permissions" => '', "condition" => NULL, "isConstraint" => false, "mask" => NULL, "maskOrder" => NULL) ;

```

We do not need to replicate the standard connect-role, as granting all permissions in the beginning also includes all connect-role permissions, listed for your reference in the screenshot below.

 ![DV_Connect_Role_Permissions.png](https://us1.discourse-cdn.com/cdata/original/1X/a2dc41944be3b3f38d87adc5167672bd2f1c54e9.png)