topic Re: How to restrict publish option to users in Management & Governance

How to restrict publish option to users

raju_salmon — Mon, 05 Nov 2018 05:07:31 GMT

Hi,

From June 2018 version onwards, we have new option called "Published" under personal category in Hub where we can publish local apps to any streams we have access.

Is there anyway we can hide this option to end users? If not can we restrict number of stream they could able to publish local apps? For example they already have access to A,B,C,D stream but i would want to allow to them to publish local apps only to stream A.

In the same way, can we restrict sheet publishing option to base sheets?

Thanks,

Raju

Re: How to restrict publish option to users

lironbaram — Mon, 05 Nov 2018 06:04:20 GMT

you can restrict user actions using security rules

so user can only read in some streams and can publish i n others

user can't publish sheets to base sheet just to the community section of the app,

and using security rules you can set which user can publish and who can't

Re: How to restrict publish option to users

raju_salmon — Mon, 05 Nov 2018 06:11:51 GMT

Great Liron, this is what i am looking for. Thanks for quick help.

Do we have any example of security rule in place which i can use?

Re: How to restrict publish option to users

Levi_Turner — Mon, 05 Nov 2018 12:34:51 GMT

Hey Raju,

Unfortunately, not until Qlik Sense September 2018. As background, historically in Qlik Sense in order to be able to publish an app object to the Community, you needed Publish rights on the App.Object as well as the Stream. This is why the default work-flow in creating a Stream security rule enables the Read as well as the Publish actions.

Generally speaking this bundling of rights hasn't mattered at any real scale. But with the introduction of the enhancements to the Hub functionality that allows publishing from the Hub, this bundling does not allow the granular control that you're looking for. This gap was fixed in Qlik Sense September 2018.

In the short-term, you can disable the publish from hub functionality until an upgrade to a later release is scheduled:

Stop all Services
Open capabilities.json
- Default path: C:\Program Files\Qlik\Sense\CapabilityService\capabilities.json
Change the enabled value to false for the flag of basic-publishing
Start all Services
(Repeat on all nodes / tiers / etc)

As a note, in order to ensure backwards compatibility, the OwnerPublishAppObject rule, which governs the ability to publish an App Object to the Community, has been changed. The new conditions retain the linkage between the publish rights on the App.Object and Stream levels:

resource.IsOwned() and resource.owner = user and resource.approved = "false" and resource.app.stream.HasPrivilege("publish")

The last part (resource.app.stream.HasPrivilege("publish")) means that in order to be able to publish the App.Object, you need publish rights on the stream. If you want to disentangle the two levels, then disable the rule and write your own, for example:

resource.IsOwned() and resource.owner = user and resource.approved = "false"

But again, this is only valid on Qlik Sense September 2018 or newer.

Hope that helps.