How to: Set up a Spark tenant

After an Excel file has been uploaded to Spark and the logic is converted to code, it is referred to as a Spark service. Folders are used to organize multiple Spark services together.

Access management basics

• A Spark customer will have access to a Keycloak realm, is referred to as a tenant.

• Check if your tenant has been set up as a Private tenant. This is denoted in the User menu. New tenants should be configured as a private tenant.

  • In a shared tenant, all users have access to all folders and services within a tenant.

  • In a private tenant, users have restricted access to folders and services depending on their group membership.

• User permissions are applied at the folder level.

Plan user groups

tenant-admin

At least one user should be nominated to be a tenant-admin. tenant-admin users can manage users, configure tenant settings, view usage data, manage active services.

In a private tenant, it is also recommended that all tenant-admin users add themselves to the supervisor:pf group.

supervisor:pf

Only applies to Private tenants.

There may be a need for intermediate-level users who don't have tenant administrator privileges but can manage all folders on a tenant. In this case, supervisor users can be created. For example, an IT team is responsible for account administration, or a team leader needs to be able to manage different folders in Spark.

In a private tenant, supervisor:pf users have full access to all services within Spark and the ability to define the permissions for each folder.

Custom user groups user:<name>

Only applies to Private tenants.

In a private tenant, separate user groups can be created to separate access across different types of users. This reflects how within an organization, different teams and users have varying levels of access to knowledge within an organization. In Spark, access to folders can be managed depending on a user's group membership. Some examples could include:

• Finance team and marketing team manage calculation and logic separately: user:finance cannot access the Marketing folder.

• American and Canadian branches of an organization: user:canada and user:us work on the Canada and US folders separately.

• A research team working on a sensitive project: user:top_secret only has access to Project X.

• An audit team that needs only read permissions: user:audit

Standard user group user:pf

• For any tenant type, users must be a member of user:pf to sign in to the Spark user interface.

Set up user accounts

Compare Benefits of identity provider versus local accounts.

Identity provider

1. Integrating your identity provider (IdP) with Single sign-on is strongly recommended for better security and alignment to organization.

2. Review IAM fundamentals and IdP recommendations.

3. Set up the integration between Spark's identity provider (IdP) (Keycloak) with yours. Use the Single sign-on guides for Entra and Okta.

4. Add any custom user groups within Keycloak.

5. Provision the user accounts through your IdP.

6. Keep group and role assignments in your organization’s IdP and use Keycloak IdP mappers to map them to Keycloak groups.

7. Tell your teams about Coherent Spark and Coherent Academy!!

Local accounts

1. Local accounts are accounts that can be created and managed through the Spark interface. They are not recommended for long term use.

2. Sign in to Spark.

3. Set up any custom User groups.

4. Add Local accounts users and assign them to the appropriate user groups. Remember user:pf membership is required to access Spark!

5. Users will receive an email invitation.

6. Tell your teams about Coherent Spark and Coherent Academy!

Add folders with specific permissions

Only applies to Private tenants.

1. Make sure you have created any additional new user groups in the previous step.

2. From the Home screen, select New folder to make a new folder and follow the steps. For guidance see Add a new folder.

3. Return to the Home screen.

4. Select the ellipsis menu of the folder and select Set permissions.

5. From the dropdown select a user or user group. You can also type characters to filter the dropdown list.

6. After adding the user or user group, the default permissions granted are read only.

7. Select the boxes for create , execute, update, delete as required. Reference Spark entity permission types. Once selected, the permissions are automatically applied. For example:

   • A "Finance projections" folder with full permissions assigned to user:finance users.

   • An audit team under user:audit can be assigned read permissions to all folders.

Set up the machine-to-machine integration

Compare Benefits of client credentials versus API keys.

Client credentials

Client credentials have the properties of a user account but are used by machines and applications.

See Client credentials for more information.

API keys

API keys can be used to integrate with the Execute API and other Spark APIs with Permissions - Features permissions.

See Authorization - API keys for more information.

Adjust tenant configurations

tenant-admin users can modify behaviors on the tenant. Recommended settings to review include:

• Include cover sheet in upload service for new service uploads: set to false.

• Enable notifications for API key expiration: set to true if you have created any API keys that are used for integration purposes.

• IP allowlisting: allow access to your Spark tenant for only a specific range of IP addresses.

• Tags: Tags categorize the service versions uploaded to Spark. Tags are set for new service versions or edited from the Version details.

• Webhook configuration: See How to: Automate workflows with webhooks.

For the full list of configurations, see Tenant configuration.