App Settings Tutorial

Audience: Application Admins

Content Summary: This page details how to use the App Settings page to configure settings for Immuta for your organization.

Navigate to the App Settings Page

1. Click the App Settings icon in the left sidebar.

2. Click the link in the App Settings panel to navigate to that section.

   

Use Existing Identity Access Manager

See the identity manager pages for a tutorial to connect an Microsoft Entra ID, Okta, or OneLogin identity manager.

To configure Immuta to use all other existing IAMs,

1. Click the Add IAM button.
2. Complete the Display Name field and select your IAM type from the Identity Provider Type dropdown: LDAP/Active Directory, SAML, or OpenID.

Immuta Accounts

To set the default permissions granted to users when they log in to Immuta, click the Default Permissions dropdown menu, and then select permissions from this list.

Link External Catalogs

See the External Catalogs page.

Enable External Masking

To enable external masking,

1. Navigate to the App Settings page and click External Masking in the left sidebar.
2. Click Add Configuration and specify an external endpoint in the External URI field.
3. Click Configure, and then add at least one tag by selecting from the Search for tags dropdown menu. Note: Tag hierarchies are supported, so tagging a column as Sensitive.Customer would drive the policy if external masking was configured with the tag Sensitive).
4. Select Authentication Method and then complete the authentication fields (when applicable).
5. Click Test Connection and then Save.

Add a Native Workspace

1. Select Add Workspace.
2. Use the dropdown menu to select the Workspace Type and refer to the corresponding tab below.

Add an Integration

1. Select Add Native Integration.
2. Use the dropdown menu to select the Integration Type and refer to the corresponding tab below.

Manage Data Providers

You can enable or disable the types of data sources users can create in this section. Some of these types will require you to upload an ODBC driver before they can be enabled. The list of currently supported drivers is on the ODBC Drivers page.

To enable a data provider,

1. Click the menu button in the upper right corner of the provider icon you want to enable.

2. Select Enable from the dropdown.

If an ODBC driver needs to be uploaded,

1. Click the menu button in the upper right corner of the provider icon, and then select Upload Driver from the dropdown.
2. Click in the Add Files to Upload box and upload your file.
3. Click Close.
4. Click the menu button again, and then select Enable from the dropdown.

Enable Email

Application Admins can configure the SMTP server that Immuta will use to send emails to users. If this server is not configured, users will only be able to view notifications in the Immuta console.

To configure the SMTP server,

1. Complete the Host and Port fields for your SMTP server.
2. Enter the username and password Immuta will use to log in to the server in the User and Password fields, respectively.
3. Enter the email address that will send the emails in the From Email field.
4. Opt to Enable TLS by clicking this checkbox, and then enter a test email address in the Test Email Address field.
5. Finally, click Send Test Email.

Once SMTP is enabled in Immuta, any Immuta user can request access to notifications as emails, which will vary depending on the permissions that user has. For example, to receive email notifications about group membership changes, the receiving user will need the GOVERNANCE permission. Once a user requests access to receive emails, Immuta will compile notifications and distribute these compilations via email at 8-hour intervals.

Initialize Kerberos

To configure Immuta to protect data in a kerberized Hadoop cluster,

1. Upload your Kerberos Configuration File, and then you can add modify the Kerberos configuration in the window pictured below.

   

2. Upload your Keytab File.

3. Enter the principal Immuta will use to authenticate with your KDC in the Username field. Note: This must match a principal in the Keytab file.
4. Adjust how often (in milliseconds) Immuta needs to re-authenticate with the KDC in the Ticket Refresh Interval field.
5. Click Test Kerberos Initialization.

Configure HDFS Cache Settings

To improve performance when using Immuta to secure Spark or HDFS access, a user's access level is cached momentarily. These cache settings are configurable, but decreasing the Time to Live (TTL) on any cache too low will negatively impact performance.

To configure cache settings, enter the time in milliseconds in each of the Cache TTL fields.

Set Public URLs

You can set the URL users will use to access the Immuta Application and Query Engine. Note: Proxy configuration must be handled outside Immuta.

1. Complete the Public Immuta URL, Public Query Engine Hostname, and Public Query Engine Port fields.
2. Opt to Enable SSL by clicking this checkbox.

Enable Sensitive Data Discovery

To enable Sensitive Data Discovery and configure its settings, see the Sensitive Data Discovery page.

Allow Policy Exemptions

Click the Allow Policy Exemptions checkbox to allow users to specify who can bypass all policies on a data source.

Default Subscription Merge Options

Immuta merges multiple Global Subscription policies that apply to a single data source; by default, users must meet all the conditions outlined in each policy to get access (i.e., the conditions of the policies are combined with AND). To change the default behavior to allow users to meet the condition of at least one policy that applies (i.e., the conditions of the policies are combined with OR),

1. Click the Default Subscription Merge Options text in the left pane.
2. Select the Default "allow shared policy responsibility" to be checked checkbox.
3. Click Save.

Note: Even with this setting enabled, Governors can opt to have their Global Subscription policies combined with AND during policy creation.

Configure Governor and Admin Settings

These options allow you to restrict the power individual users with the GOVERNANCE and USER_ADMIN permissions have in Immuta. Click the checkboxes to enable or disable these options.

Create Custom Permissions

You can create custom permissions that can then be assigned to users and leveraged when building subscription policies. Note: You cannot configure actions users can take within the console when creating a custom permission, nor can the actions associated with existing permissions in Immuta be altered.

To add a custom permission, click the Add Permission button, and then name the permission in the Enter Permission field.

Create Custom Data Source Access Requests

To create a custom questionnaire that all users must complete when requesting access to a data source, fill in the following fields:

1. Opt for the questionnaire to be required.
2. Key: Any unique value that identifies the question.
3. Header: The text that will display on reports.
4. Label: The text that will display in the questionnaire for the user. They will be prompted to type the answer in a text box.

Create Custom Login Message

To create a custom message for the login page of Immuta, enter text in the Enter Login Message box. Note: The message can be formatted in markdown.

Opt to adjust the Message Text Color and Message Background Color by clicking in these dropdown boxes.

Generate System API Key

1. Click the Generate Key button.
2. Save this API key in a secure location.

Prevent Automatic Table Statistics

To disable the automatic collection of statistics with a particular tag,

1. Use the Select Tags dropdown to select the tag(s).

2. Click Save.

SQL Credential Password Requirements

Users can add password requirements for SQL credentials in this section, including minimum length, maximum length, and minimum number of symbols, numbers, uppercase, and lowercase characters. This will set password requirements for any new SQL credentials or any updated passwords. Previous Query Engine accounts will not be subject to the newly applied password restrictions.

To ensure that users are not easily compromised, minimum password requirements have been added as default. The password requirements can be changed to fit certain standards.

Advanced Settings

Preview Features

If you enable any Preview features, please provide feedback on how you would like these features to evolve.

Policy Adjustments

1. Click Advanced Settings in the left panel, and scroll to the Preview Features section.
2. Check the Enable Policy Adjustments checkbox.
3. Click Save.

Health Expert Determination

1. Click Advanced Settings in the left panel, and scroll to the Preview Features section.

2. Check the Enable Policy Adjustments checkbox.

3. Check the Enable Health Expert Determination checkbox.

4. Click Save.

Complex Data Types

1. Click Advanced Settings in the left panel, and scroll to the Preview Features section.
2. Check the Allow Complex Data Types checkbox.
3. Click Save.

Enhanced Subscription Policy Variables

For instructions on enabling this feature, navigate to the Global Subscription Policies Advanced DSL Tutorial.

Advanced Configuration

Advanced configuration options provided by the Immuta Support team can be added in this section. The configuration must adhere to the YAML syntax.

Update the K-Anonymity Cardinality Cutoff

To increase the default cardinality cutoff for columns compatible with k-anonymity,

1. Expand the Advanced Settings section and add the following text to the Advanced Configuration:

   plugins:
     postgresHandler:
       maxKAnonCardinality: 10000000
     snowflakeHandler:
       maxKAnonCardinality: 10000000
   

2. Click Save.

3. To regenerate the data source's fingerprint, navigate to that data source's page.
4. Click the Status in the upper right corner.
5. Click Re-run in the Fingerprint section of the dropdown menu.

Note: Re-running the fingerprint is only necessary for existing data sources. New data sources will be generated using the new maximum cardinality.

Update the Time to Webhook Request Timeouts

1. Expand the Advanced Settings section and add the following text to the Advanced Configuration to specify the number of seconds before webhook requests timeout. For example use 30 for 30 seconds. Setting it to 0 will result in no timeout.

   webhookIntegrationResponseTimeout: 30
   

2. Click Save.

Update the Audit Ingestion Expiration

1. Expand the Advanced Settings section and add the following text to the Advanced Configuration to specify the number of minutes before an audit job expires. For example use 300 for 300 minutes.

   plugins:
     auditService:
       ingestionJob:
         expirationInMinutes: 300
   

2. Click Save.

Turn Off Query Text Transfer

By default, Immuta includes the query text in audit records, which requires it to transfer from the data platform to Immuta. To turn off this feature and stop audit records from including query text,

1. Expand the Advanced Settings section and add the following text to the Advanced Configuration:

   featureFlags:
     AuditExcludeQueryText: true
   

2. Click Save.

Administer Features

The Query Engine grants Immuta user accounts proxied data query access to Immuta data sources through the Immuta API and the Query Editor in the Immuta UI.

Application Administrators can turn off the Query Engine to ensure data does not leave a data localization zone when authorized users access the Immuta Application outside data jurisdiction.

To disable this feature,

1. Click Advanced Settings in the left panel, and scroll to the Administer Features section.

2. Select the Disable radio button and click Save.

3. Click Confirm to deploy your changes.

Deploy Configuration Changes

When you are ready to finalize your configuration changes, click the Save button at the bottom of the left panel, and then click Confirm to deploy your changes.