Skip to main content
Solved

Merge Realm Roles

  • May 13, 2025
  • 3 replies
  • 48 views
Raja Koushik
Data Enthusiast

We have multiple Realm roles created for our data domains in the below fashion

  • Data Domain 1
    • Realm Role - Data Owner
    • Realm Role - Data Steward
  • Data Domain 2
    • Realm Role - Data Owner
    • Realm Role - Data Steward

How can IĀ merge Data Domain 1 and Data Domain 2 into one single New Domain and merge the corresponding Realm Roles?

I.e.

  • Data Domain 1
    • Realm Role - Data Owner
    • Realm Role - Data StewardĀ  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  = New Data Domain
  • Data Domain 2Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā New Realm Role - Data Owner
    • Realm Role - Data OwnerĀ  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā  Ā Ā New Realm Role - Data Steward
    • Realm Role - Data Steward

Best answer by Lisa Kovalskaia

ā€‹@Raja KoushikĀ Thank you for the feedback! Thereā€™s another option you might consider. If you create a new Ataccama Group and makeĀ both Data Domain 1 and Data Domain 2 Groups its children, and map your existing domainsā€™ realm roles to this new parent Group, then thanks to the oversight mechanism members of the new parent Group will have access to anything shared with either of the child Groups. In this case, thereā€™s no need to reshare anything or switch stewardship. End users will continue using the twoĀ Data Domain Groups to share and assign ownership, whileĀ the new ā€˜metadomainā€Ā  Group will provide cross-domain visibility.

This option simplifies the merge, but of course the Groups hierarchy needs to matchĀ the way your organization will think about the data domainsĀ and the relationships between them. A ā€œsoft mergeā€ is a good ideaĀ if reflects the business transformation youā€™re going through.

Iā€™m sure thereā€™s space to explore the use case further from the product design perspective. Youā€™re very welcome to share your use case and suggestionsĀ on the dedicated Community sectionĀ https://community.ataccama.com/ideas. Thank you!

A

3 replies

Lisa Kovalskaia
Ataccamer
Forum|alt.badge.img+3

ā€‹@Raja KoushikĀ hi, hereā€™s how Iā€™d go about it:

  1. Create new realm roles in Keycloak
  2. Assign users with the new domain roles. Do not remove existing realm roles from users so that they continue to work with the Ataccama app with their existing roles. If you have a large number of users you might consider using Keycloak APIs i.e.Ā POST /admin/realms/{realm}/groups/{group-id}/role-mappings/realm
  3. Create new Group in Ataccama, map new realm roles to Governance Roles within the group.
  4. Filter out assets that have Stewardship assigned to one of the pre-existing domain Groups, and reassign Stewardship to the new Group. You can use mass actions in Ataccama to do that.
  5. Reshare all relevant assets from the pre-existing domain Groups to the new Group. You can manage sharing via mass actions too.
  6. Check monitoring project notification settings and remap them to new Group or realm rolesĀ as needed.Ā 
  7. If you have any custom metadata properties that reference Groups, youā€™d need to export relevant assets and update this propertyĀ via a ONE Desktop plan (or manually).
  8. Ā Now remove the obsolete realm roles from users in Keycloak.
  9. I would keep the obsolete Groups in Ataccama Global Settings, and keep their realm roles mappings. Groups could be renamed for clarity and a description can be added to point to the new domain Group that replaced them.Ā It may be useful in case they were mentioned somewhere in comments, tasks. I can also imagine some edge cases might emerge later and it would be back to have an easy way to refer/revert back.

Does this make sense? If you have any additional questions or concerns regarding your specific setup, please let me know!

A
Raja Koushik
Raja Koushik
Data Enthusiast
  • Raja KoushikData Enthusiast
  • Author
  • Data Enthusiast
  • May 27, 2025

Hi ā€‹@Lisa KovalskaiaĀ , thank you so much for sharing the detailed steps, I was thinking in the same direction but wanted to see if there was an easier way to do it. Perhaps food for thought for ā€‹@Ataccama.

ā€‹@CansuĀ - This is probably a feature Ataccama can consider in the future.

Ā 

Thanks

Raja

A
Lisa Kovalskaia
Ataccamer
Forum|alt.badge.img+3

ā€‹@Raja KoushikĀ Thank you for the feedback! Thereā€™s another option you might consider. If you create a new Ataccama Group and makeĀ both Data Domain 1 and Data Domain 2 Groups its children, and map your existing domainsā€™ realm roles to this new parent Group, then thanks to the oversight mechanism members of the new parent Group will have access to anything shared with either of the child Groups. In this case, thereā€™s no need to reshare anything or switch stewardship. End users will continue using the twoĀ Data Domain Groups to share and assign ownership, whileĀ the new ā€˜metadomainā€Ā  Group will provide cross-domain visibility.

This option simplifies the merge, but of course the Groups hierarchy needs to matchĀ the way your organization will think about the data domainsĀ and the relationships between them. A ā€œsoft mergeā€ is a good ideaĀ if reflects the business transformation youā€™re going through.

Iā€™m sure thereā€™s space to explore the use case further from the product design perspective. Youā€™re very welcome to share your use case and suggestionsĀ on the dedicated Community sectionĀ https://community.ataccama.com/ideas. Thank you!

A
Community Terms of Use & ConditionsCookie settingsAccessibility statement