topic Re: restrict the creation of a folder data connection on a specific network path in App Development

restrict the creation of a folder data connection on a specific network path

ali_hijazi — Wed, 09 Jul 2025 06:52:43 GMT

Hello
I'm working on Qlik sense enterprise
I want to restrict developers from creating a folder data connection to a network path
I know this can be accomplished via security rules
I created a security rule as follows:

Resource Filter: DataConnection_*
Actions: Create
Conditions: resource.resourcetype = "DataConnection"
and
( (resource.type = "folder" and !(resource.Path like "*\\\\qliksenseprd\\QlikSense\\Technical STORE QVDs\\QDF_FIN*")))

however when I go to the load editor, the create-new-connection button at the top right is disabled as if the security rule failed

Re: restrict the creation of a folder data connection on a specific network path

Kaushik2020 — Thu, 07 Aug 2025 04:21:03 GMT

Hi @ali_hijazi , Are you planning to restrict the create connection option or only the folder creation ?

Re: restrict the creation of a folder data connection on a specific network path

ali_hijazi — Thu, 07 Aug 2025 05:32:33 GMT

Hi @Kaushik2020

Yes mainly folder data connection creation

Regards,

Re: restrict the creation of a folder data connection on a specific network path

Kaushik2020 — Thu, 07 Aug 2025 08:48:31 GMT

Re: restrict the creation of a folder data connection on a specific network path

ali_hijazi — Thu, 07 Aug 2025 06:51:21 GMT

I don't want to restrict reading the folder data connection
I want to allow developers to create a folder data connection except for the specified location
Please read my question fully before throwing hap-hazard answers

Re: restrict the creation of a folder data connection on a specific network path

Kaushik2020 — Thu, 07 Aug 2025 08:50:24 GMT

you can modify the security rule to add your conditions. In our environment we have defined on who can create a folder in folder lever security. Not from Qlik Sense.

Re: restrict the creation of a folder data connection on a specific network path

ali_hijazi — Thu, 07 Aug 2025 08:57:29 GMT

Hello @Kaushik2020
in the company we have several Teams of developers
let's say Team1 and Team2
both teams are allowed to create any folder connection. However members of Team2 are not allowed to create a folder data connection to
\\server_name\QlikSense\Technical STORE QVDs\QDF_FIN

Re: restrict the creation of a folder data connection on a specific network path

Kaushik2020 — Thu, 07 Aug 2025 10:45:30 GMT

In my case, I have restricted it via the folder security inside the Server user group. I hope same should be possible with QMC Security rules.

Re: restrict the creation of a folder data connection on a specific network path

ali_hijazi — Thu, 07 Aug 2025 11:56:34 GMT

the thing is that the process behind the script is executed by the user account that runs the Qlik Sense engine. So even if you restrict users from accessing the folder via windows, the developer can still create a connection to that folder and even run the script successfully because it is ran by that service account.

Re: restrict the creation of a folder data connection on a specific network path

Kaushik2020 — Thu, 07 Aug 2025 12:38:08 GMT

The account which is used to login to Qlik Sense should be configured. When we reload the Qlik Sense user id is recognized in the server.

Re: restrict the creation of a folder data connection on a specific network path

ali_hijazi — Thu, 07 Aug 2025 12:42:44 GMT

thank you very much for your pointless answers

Re: restrict the creation of a folder data connection on a specific network path

howdash — Thu, 07 Aug 2025 15:12:28 GMT

Hi @ali_hijazi,

The security rule doesn't have the functionality to control to which folders a data connection can and cannot be created. It looks like it does, but it actually doesn't. The security rule is binary in a sense that it either allows creation of a folder connection or it doesn't.

To answer your question, in order to block creation of a data connection to a specific folders, you would need to block access in to those folders for whatever user or service account you use to run your Qlik Sense services.

For example, let say the account that you use to run your Qlik Sense services is ServiceQlikSense. And the path that you don't want folder data connections to be created is \\qliksenseprd\QlikSense\Technical. You would need to:

Step 01.

Go to the properties of the Technical folder, go to the Security tab and click the Advanced button, this one:

Step 02.

Then click the Add button:

Step 03.

Click the Select a principal link:

Step 04.

Enter the username of the service account that runs your Qlik Sense services.

Step 05.

Click the Check Names button.

Step 06.

Click the OK button.

Step 07.

Back in the Permission Entry for Technical folder window, select the Deny in the Type dropdown.

Step 08.

Select Full Control to deny all access to the folder.

Step 09.

Click the OK button to save folder permissions.

Step 10.

Click the OK button in the Advanced Security Settings window.

Step 11.

Click the OK button in folder properties window.

Now that the service account was denied access to the Technical folder, when developers will go to create a data connection to that folder, they will be able to type the path to the folder but the Create button will be grayed out, effectively not allowing them to create a data connection to that folder. Here's what that will look like: