topic Re: How to allow non-Admin users download task log? in Management & Governance

How to allow non-Admin users download task log?

Jeffrey_Li — Wed, 28 Aug 2019 13:01:56 GMT

Hi, All,

We want to allow some non-Admin users to be able to download Qlik Sense task log. Currently when one user tried to download log, he got error. Please see attached image. Which security rules control that?

Thanks

Re: How to allow non-Admin users download task log?

Levi_Turner — Wed, 28 Aug 2019 16:41:06 GMT

It looks like the actual download calls this endpoint: /qrs/ReloadTask/{reloadTaskId}/scriptlog?fileReferenceId={fileReferenceId}

So I'd guess this would be the rule that is needed:

Filter: FileReference_*
Action: Read
Conditions: Whatever conditions you want to use
Context: QMC

Re: How to allow non-Admin users download task log?

Jeffrey_Li — Wed, 28 Aug 2019 17:29:03 GMT

Hi, LeviTurner,

Thanks for your reply, but It doesn't work.

Regards

Re: How to allow non-Admin users download task log?

Jeffrey_Li — Wed, 28 Aug 2019 17:30:19 GMT

Also, how do you find it calls this /qrs/ReloadTask/{reloadTaskId}/scriptlog?fileReferenceId={fileReferenceId}?

Re: How to allow non-Admin users download task log?

Levi_Turner — Wed, 28 Aug 2019 20:15:48 GMT

Yeah, not sure what the hiccup is on your end. This rule fails with insufficient privileges:

Filter: QmcSection_Task,ReloadTask*
Actions: Read
Conditons: ((user.name="taskloguser"))
Context: QMC

This rule works:

Filter: QmcSection_Task,ReloadTask*,FileReference*
Actions: Read
Conditons: ((user.name="taskloguser"))
Context: QMC

The first two filters just expose the Tasks section of the QMC and the actual tasks, which your user presumably already has.

For my condition, I am obviously scoping this to just a test user. So you'd want to use something more robust like group membership, a role, etc.

Re: How to allow non-Admin users download task log?

benwashburne — Wed, 08 Jan 2020 01:53:22 GMT

@Levi_Turner This worked for me, thanks! I had to search for this solution because after some update (I don't know which one) I was no longer able to see the logs. I am a content and security admin so I assumed I could always view them - you don't happen to know of any security rule changes that would have altered this, do you?

Re: How to allow non-Admin users download task log?

Levi_Turner — Wed, 08 Jan 2020 17:09:45 GMT

My understanding is that there was increased hardening to QSE which requires explicit rights to FileReference_*, see https://support.qlik.com/articles/000080215.