QS Security by application/user automated

DireStraits — Wed, 08 Mar 2023 07:25:15 GMT

Hi,

Currently we are managing QS security at Stream level. We are loading an Excel file containing User/Stream relationship via User directory connectors. If we create a new Stream we only have to associate the user with the Excel loaded users and the value with the loaded Stream values:

This works perfectly since it allows us to manage Stream/User security in an easy way. Now I'm trying to add security at application level while mantaining the same level of automation. The idea is to create a new file containing User/Application relationship and load this in an automated way. I want to avoid managing users in the qmc..

Anyone knows if this is possible?

Thanks.

Re: QS Security by application/user automated

Eduardo_Monteiro — Fri, 10 Mar 2023 02:39:14 GMT

Hello @DireStraits

Yes, it is possible. I did it using Custom Properties and AD groups.

Create a custom property like "AppLevelSecurity" and add the AD group names as values in the custom property.

Replace default "Stream" security rule with the following condition:

(resource.resourcetype = "App" and resource.stream.HasPrivilege("read") and (resource.@AppLevelSecurity.empty() or resource.@AppLevelSecurity = user.group)) or ((resource.resourcetype = "App.Object" and resource.published ="true" and resource.objectType != "app_appscript" and resource.objectType != "loadmodel") and resource.app.stream.HasPrivilege("read"))

And then create a rule binding it to ad group, see the conditions below:

((user.group=resource.@AppLevelSecurity ))

Please let me know if this is helpful.

BR,

Eduardo Monteiro

topic QS Security by application/user automated in Management & Governance

QS Security by application/user automated

Re: QS Security by application/user automated