Best practices for using service accounts in Collibra
Hi everyone!
We create a lot of automation services that would feed Collibra DGC from other metadata sources.
Currently we use Identity Provider with SSO.
So what are best practices for using service accounts operate with Collibra?
I suspect that could be LDAP service accounts and using JWT with Collibra API for authentication.
Would like to know a little more about your practises and technical details
ruslanahmetzyanov
Posted 4 years ago · Edited 1 year ago·Last reply 4 years ago
8 comments
ruslanahmetzyanov
OP4 years ago · EditedHi @alvin.useree! Thank you for your insight about API call tracking - that would be really helpful for us.
Certainly we could parse it ourselves.
Btw, for cloud instance we were able to get groups and users for LDAP.
alvinuseree
·4 years ago · Edited@ruslan.ahmetzyanov My bad - Thanks for keeping me humble!If you don’t mind me asking, what AD are you syncing to?
I was thinking back to a previous implementation where LDAP wasn’t possible - I think it was an on-prem AD with Collibra in the cloud that didn’t make it possible!
alvinuseree
·4 years ago · EditedHey both @noor.shaik and @ruslan.ahmetzyanov , just adding to the above. The most secure means of authenticating through the Collibra APIs is indeed via JWT. Although via jobserver and edge, basic authentication is used.
You can’t authenticate using a SSO created account unfortunately and if you’re on cloud I don’t believe you can sync users via LDAP.
Your best option is to either create the service account manually and manage in Collibra or sync your active directory to Collibra via an API integration (there are a few examples on this forum) and manage the service account in your active directory.
As for API call tracking, check this: https://productresources.collibra.com/docs/collibra/latest/Content/Console/DiagnosticFiles/Logs/ta_configure-logging-api-calls.htm
What the above does is log API calls to the dgc logger. So your problem statement now becomes: how to parse the logs.
There are various ways to achieve this, I suggest looking at: https://marketplace.collibra.com/listings/log-proxy/
It’s also quite straight forward to this programmatically yourself via a Python or whatever language you’re comfortable with.
Cheers!
Alvin Useree
ruslanahmetzyanov
OP4 years ago · Edited@noor.shaik, got it.
However, do you know is there a way to get API calls history not only from user interface?
Alexandra Jorgenson
Admin4 years ago · Edited@ruslan.ahmetzyanov, if you don’t get a response to this new question from @noor.shaik or anyone else in the timeframe you were hoping, I suggest you create a new post/thread with this question.
ruslanahmetzyanov
OP4 years ago · Edited@noor.shaik , thank you for reply. So you just use built-in account in Collibra for API ingestion.
By the way, do you know, is it possible to keep track of all API calls to Collibra?
noor
·4 years ago · Editedwe have “started by” field in activities page, right…there for our tech user for APIs based metadata ingestion, we see its name…
so that way we know which job/activity was triggered by whom…
noor
·4 years ago · EditedWe created technical users in Collibra - one for Jobserver/EDGE based ingestion, one for APIs based ingestion…
User name won’t have env name in it. Both User name and password are stored in key vault.
For APIs based ingestion, we read password from keyvault, and authenticate…