DataMasque Portal

User Management

Overview

DataMasque supports both local user account management and federated user account management via SAML single sign-on.

The user management console allows DataMasque admin users to manage local user accounts and revoke and restore access for local user accounts.

To access the user management console, choose the Users item from the main menu while logged in as an admin user.

The authentication method for each user account can be determined by the Type column of the user list. Local user accounts are indicated by the Local account type. Such users are authenticated by DataMasque using their username and password. Federated user accounts that authenticate with single sign-on are indicated by the SSO account type.

Users list

User Roles and Privileges

User Mgmt Connection Mgmt Ruleset Mgmt Ruleset Libraries Data Masking Runs Licence Mgmt Files Mgmt Logs Application Settings
Admin Yes Yes Yes Yes Yes Yes Yes Yes Yes
Mask Builder No Yes Yes Optional Yes No Yes No No
Mask Runner No Yes No No Yes No No No No
  • Admin users are created during DataMasque installation, and additional admin users can be promoted from existing non-SSO users or created directly.
  • Mask Builder and Mask Runner users can be created and edited in the 'Users' page by admin users.
  • All Mask Builder users can view ruleset libraries, and create rulesets that reference existing libraries. To grant Mask Builder users permission to create, edit, and delete ruleset libraries, enable the Can Manage Ruleset Libraries permission checkbox when creating or editing a Mask Builder user. See the Permissions section of the Ruleset Library documentation for more details.

Add a New User

To add a new local DataMasque user, click the Add button button on the Users page.

The 'New User' form allows you to configure the user details. For more information about each field, see the table below.

Once the user details have been completed, click the SAVE button to create the user.

A temporary password will be automatically generated for the new user. This password must be saved and provided to the new user to log in to their new account. The user will be prompted to set a new password on first login. Their new password must comply with the DataMasque Password Policy.

Warning: The temporary password for a new user will not be available after closing the confirmation panel. It is important to save this password elsewhere to avoid being locked out of the account.

New user account details
Username A unique username with a maximum length of 255 characters. Must be alphanumeric, with the following symbols also allowed: @ . + - _
Email The user's email address. This must be unique among all users.
Role The role assigned to the user, determining their permissions and access level.

Edit User Form

Note: Local user account creation may be disabled if the "Disable local logins" setting is enabled in the SAML Single Sign-On settings.

Note: For information on provisioning user accounts under single sign-on, see the user provisioning and management section of the SAML Single Sign-On user guide.

Edit User

User accounts may be updated by selecting the user in the Users list.

Using the Edit User form, it is possible to update the user's account details. Additionally, the user's access to DataMasque can be revoked by disabling the user account. The user's access can be restored at any time by re-enabling a disabled account. A disabled user can no longer log into the DataMasque dashboard.

Note: Account details of single sign-on (SSO) users are not editable using the DataMasque user management console except for changing their Role.

Edit User Form

Delete User

Admin users can permanently delete a user account from the Edit User form. To delete a user, click the Delete User… button in the Danger Zone section.

A confirmation dialog will appear, requiring you to type the exact username to confirm the deletion. Once confirmed, the user account is permanently removed and cannot be recovered.

Warning: Deleting a user is irreversible. Consider disabling the account instead if you may need to restore access in the future.

The Delete User… button is disabled when viewing your own account, as you cannot delete the account you are currently logged in with. Both local and SSO user accounts can be deleted.

What happens when a user is deleted

The following data is permanently removed along with the user account:

  • Authentication tokens
  • User profile
  • SSH keys
  • Notification preferences

The following data is preserved:

  • Audit log entries — the user field is cleared, but the username string is retained in the log for traceability.
  • Masking run history — any association with the deleted user is cleared, but the run records themselves are kept.

Connections, databases, rulesets, and masking runs are not affected by user deletion.

Password Policy

DataMasque user passwords must conform to the following password policy:

  • Minimum password length is 8 characters.

  • Must not contain three or more sequential characters (e.g. "123").

  • Must not contain three or more repeated characters (e.g. "aaa").

  • Must not be similar to username or email or contain the words masque or mask.

  • Must not match any value in this list of 100,000 common passwords: https://www.ncsc.gov.uk/static-assets/documents/PwnedPasswordsTop100k.txt

Users have 5 attempts at logging in. If they are unsuccessful, their account will be locked and will need to be reset by an admin user.

For a guide to reset a user's password please follow the Password Troubleshooting Guide.