Register Repository Users

A repository user is a database credential configured in ALTR for impersonation. Registering a repository user enables the sidecar to retrieve that credential and use it for the database session when a data consumer connects through single sign-on.

Prerequisites

• The database credential for the repository user is stored in a supported credential provider: AWS Secrets Manager, Azure Key Vault, Environment Variable, or Local File.

Choosing a credential provider: AWS Secrets Manager is best when your infrastructure already runs in AWS. Azure Key Vault is best when your infrastructure already runs in Azure. Environment Variable is intended for proof-of-concept/testing use, not production. Local File is useful for testing, or for on-prem/similar deployments where cloud secret managers aren’t available.

To register a repository user:

1. Log in to ALTRNet through your identity provider (IdP).
2. Select Data Configuration > Data Sources in the navigation menu.
3. Select Repositories from the Type dropdown.
4. Click the repository.
5. Click the Users tab.
6. Click Register Repository User.
7. Enter the repository username in Username. This is the username for the underlying database credential.
8. Select the Secret Source.
9. Populate the fields for the selected secret source:
   • AWS Secrets Manager: enter the Amazon Resource Name (ARN), copied directly from the secret source.
   • Azure Key Vault: enter the Secret Name and the Vault URI, copied directly from the secret source.
   • Environment Variable: enter the Variable Name — the name of the environment variable set on the sidecar that contains the credential.
   • Local File: enter the Path — a filename with no directory separators; ALTR resolves it under the sidecar’s /altr/secrets/ directory (for example, db_password resolves to /altr/secrets/db_password).
10. Click Register User. ALTRNet adds the user to the repository’s Users tab.

Note

The sidecar needs access to the configured secret source to retrieve a repository user’s credential. Contact ALTR Support if you need help configuring access for any secret source.

Note

AWS Secrets Manager and Azure Key Vault support plaintext secret values only. Formatted secret objects — such as AWS Secrets Manager’s structured RDS-style JSON secrets, with username, password, host, and port fields — aren’t supported for either provider. Store the repository user’s credential as a plaintext value in the vault.

Edit Repository Users

Edit a repository user to update its username or the fields specific to its secret source.

To edit a repository user:

1. Log in to ALTRNet through your IdP.
2. Select Data Configuration > Data Sources in the navigation menu.
3. Select Repositories from the Type dropdown.
4. Click the repository to view its details.
5. Click the Users tab.
6. Locate the repository user and click Edit.
7. Update the repository user.
8. Click Save. ALTRNet applies the update to the repository user.

Remove a Repository User

Removing a repository user prevents it from being used in impersonation policies. Update any impersonation policy that references the user to exclude it before removing the user.

To remove a repository user from ALTR:

1. Log in to ALTRNet through your IdP.
2. Select Data Configuration > Data Sources in the navigation menu.
3. Select Repositories from the Type dropdown.
4. Click the repository to view its details.
5. Click the Users tab.
6. Locate the repository user and click Edit.
7. Click Remove. ALTRNet displays a confirmation modal.
8. Click Remove to confirm.