Creating an MC User

MC provides two authentication schemes for MC users: LDAP or MC (internal). Which method you choose will be the method MC uses to authenticate all MC users. It is not possible to authenticate some MC users against LDAP and other MC users against credentials in the database through MC.

• MC (internal) authentication. Internal user authorization is specific to MC itself. You create a user with a username and password combination. This method stores MC user information in an internal database on the MC application/web server, and encrypts passwords. Note that these MC users are not system (Linux) users; they are entries in the MC’s internal database.
• LDAP authentication. All MC users—except for the MC super administrator, which is a Linux account—are authenticated based on search criteria against your organization's LDAP repository. MC uses information from LDAP for authentication purposes only and does not modify LDAP information. Also, MC does not store LDAP passwords but passes them to the LDAP server for authentication.

Instructions for creating new MC users are in this topic.

• If you chose MC authentication, follow the instructions under Create a New User Authenticated by MC.
• If you chose LDAP authentication, follow the instructions under Create a New User from LDAP.

See About MC Users and LDAP Authentication for more information.

Prerequisites

Before you create an MC user, you already:

• Created a database directly on the server or through the MC interface, or you imported an existing database cluster into the MC interface. See Managing Database Clusters.
• Created a database user account (source user) on the server, which has the privileges and/or roles you want to map to the new (target) MC user. See Creating a Database User.
• Know what MC privileges you want to grant the new MC user. See About MC Privileges and Roles.

If you have not yet met the first two above prerequisites, you can still create new MC users; you just won't be able to map them to a database until after the database and target database user exist. To grant MC users database access later, see Granting Database Access to MC Users.

Create a New User Authenticated by MC

1. Sign in to Management Console as an administrator and navigate to MC Settings > User management.
2. Click Add.

3. Enter the MC username.

   Note: It is not necessary to give the MC user the exact same name as the database user account you'll map the MC user to in Step 7. What matters is that the source database user has privileges and/or roles similar to the database role you want to grant the MC user. The most likely scenario is that you will map multiple MC users to a single database user account. .

4. Let MC generate a password or create one by clicking Edit password. If LDAP has been configured, the MC password field will not appear.
5. Optionally enter the user's e-mail address.
6. Select an MC configuration permissions level. See MC Configuration Privileges.

7. Next to the DB access levels section, click Add to grant this user database permissions.

   1. Choose a database. Select a database from the list of MC-discovered (databases that were created on or imported into the MC interface).
   2. Database username. Enter an existing database user name or, if the database is running, click the ellipsis […] to browse for a list of database users, and select a name from the list.
   3. Database password. Enter the password to the database user account (not this username's password).
   4. Restricted access. Chose a database level (ADMIN, IT, or USER) for this user.
   5. Click OK to close the Add permissions dialog box.
8. Leave the user's Status as enabled (the default). If you need to prevent this user from accessing MC, select disabled.
9. Click Add User to finish.

Create a New LDAP-authenticated User

When you add a user from LDAP on the MC interface, options on the Add a new user dialog box are slightly different from when you create users without LDAP authentication. Because passwords are store externally (LDAP server) the password field does not appear. An MC administrator can override the default LDAP search string if the user is found in another branch of the tree. The Add user field is pre-populated with the default search path entered when LDAP was configured.

1. Sign in to Management Console and navigate to MC Settings > User management.

2. Click Add and provide the following information:

   1. LDAP user name.
   2. LDAP search string.
   3. User attribute, and click Verify user.
   4. User's email address.
   5. MC configuration role. NONE is the default. See MC Configuration Privileges for details.
   6. Database access level. See MC Database Privileges for details.
   7. Accept or change the default user's Status (enabled).
3. Click Add user.

If you encounter issues when creating new users from LDAP, you'll need to contact your organization's IT department.

How MC Validates New Users

After you click OK to close the Add permissions dialog box, MC tries to validate the database username and password entered against the selected MC-managed database or against your organization's LDAP directory. If the credentials are found to be invalid, you are asked to re-enter them.

If the database is not available at the time you create the new user, MC saves the username/password and prompts for validation when the user accesses the Database and Clusters page later.