topic Re: Disabling "Create new sheet" and other options in Management & Governance

Disabling "Create new sheet" and other options

vlad_komarov — Fri, 25 Sep 2015 20:08:18 GMT

Hi,

Just looking for a solution to disable "Add Data", "Duplicate Sheet" , "Delete Sheet" , "Export Sheet", "Create new sheet" options.

Is it possible in QS v. 1.x or 2.x?

Regards,

Vladimir

Re: Disabling "Create new sheet" and other options

Gysbert_Wassenaar — Sat, 26 Sep 2015 15:38:00 GMT

That should be possible in both by creating custom security rules for those action - resource type combinations. See the online help for more information: http://help.qlik.com/sense/2.0/en-US/online/#../Subsystems/ManagementConsole/Content/security-rules-overview.htm%3FTocPa…

Re: Disabling "Create new sheet" and other options

vlad_komarov — Tue, 29 Sep 2015 14:46:44 GMT

Gysbert, Thank you for reply. I've reviewed the help article, but I would need some clarification how to apply a newly created rule to specific control/action/system feature in the application. Could you please provide some examples?

Regards,

Vladimir

Re: Disabling "Create new sheet" and other options

vlad_komarov — Tue, 29 Sep 2015 14:55:54 GMT

To simplify the task: It's not clear for me how to apply a "Read Only" rule for users. Will the Selection functionality work in this case? It's more confusing in QS vs. QV, IMHO.

Re: Disabling "Create new sheet" and other options

rubenmarin — Tue, 29 Sep 2015 15:30:48 GMT

Hi Vladimir, I'm not an expert in sense security yet but take care with already active rules.

In example there is a rule CreateAppObjectsPublishedApp wich gives permission to create sheets to all user that can read the app.

You should disable or make more restrictive this rule in example adding a custom property or admin role to users and adding this restriction to the rule: and (user.@role="Admin")

This way the rule only applies if the user has its custom property "role" with the value "Admin"

Again, I'm not an expert in this, still learning.

Re: Disabling "Create new sheet" and other options

vlad_komarov — Tue, 29 Sep 2015 20:32:48 GMT

Ruben,

Thank you for reply. Have tried it, but this option does not seems to work.

Here is the code:

Filter:

App.Object_*

Condition:

!resource.App.stream.Empty() and resource.App.HasPrivilege("read") and (resource.objectType = "userstate" or resource.objectType = "sheet" or resource.objectType = "story" or resource.objectType = "bookmark" or resource.objectType = "snapshot" or resource.objectType = "embeddedsnapshot" or resource.objectType = "hiddenbookmark") and (user.@role="RootAdmin" or user.@role="ContentAdmin")

And the "Create New Sheet" option is still available on published stream...

I've cleared the Browser History and Cookies, just to make sure, but still no changes...

😠

Re: Disabling "Create new sheet" and other options

vlad_komarov — Tue, 29 Sep 2015 21:42:42 GMT

I've found this article on QS help site (😞

https://help.qlik.com/sense/1.1/en-US/online/Subsystems/ManagementConsole/Content/ServerUserGuide/SUG_ConfiguringSecurit…

A bit complicated approach, but seems to work for my case.

Thank you for suggestions!

Regards,

Vladimir

Re: Disabling "Create new sheet" and other options

rubenmarin — Wed, 30 Sep 2015 07:59:13 GMT

OK, just to clarify... "RootAdmin" and "ContentAdmin" are predefedined Admin Roles, wich is a different approach than using a custom property named 'role'.

If you are using admin roles, the syntax in security rules should be:

and (user.roles="RootAdmin" or user.roles="ContentAdmin")

Re: Disabling "Create new sheet" and other options

korsikov — Wed, 30 Sep 2015 12:28:11 GMT

hey do you speak in Russian?

I recently solved a similar question now find examples of its safety regulations.

Я уверен что проблема в том что не отключено правило безопасности по умолчанию отвечающее за создание новых приложений.Называется "CreateApp" его необходимо для начала выключить, а потом создать свое правило определяющее группу пользователей которые могут создавать приложения.

вот пример взял из хелпа

resorce filter App_*,FileReference_*

condition ((user.@Usertype="Developer")) and !user.IsAnonymous()

only in hub

Action : create

Если есть какие то еще вопросы по правилам безопасности пишите, это моя любимая тема для исследований.

Re: Disabling "Create new sheet" and other options

vlad_komarov — Wed, 30 Sep 2015 23:05:35 GMT

Еще как говорю!

Разбираться с новым продуктом без Русского мата иногда тяжело...

Будет хоть с кем поделится...

I did exactly that, have created custom rules, disabling "standard" ones (based on https://help.qlik.com/sense/1.1/en-US/online/Subsystems/ManagementConsole/Content/ServerUserGuide/SUG_ConfiguringSecurit… ‌info).

But still having few issues, primarily in handling consequences of these new rules activation. I will try to submit the list of issue a later today.

Re: Disabling "Create new sheet" and other options

korsikov — Thu, 01 Oct 2015 06:49:22 GMT

Тогда ждем вопросов еще

We expect additional questions from you today. better in the form of individual topics.

Re: Disabling "Create new sheet" and other options

vlad_komarov — Thu, 01 Oct 2015 15:59:51 GMT

Ruben,

I've checked the "default" CreateAppObjectsPublishedApp rule and it contains the following code:

and (user.@role="RootAdmin" or user.@role="ContentAdmin"), so system admin roles are using @ as well.

Could you please comment on that?

Regards,

Vladimir

Re: Disabling "Create new sheet" and other options

vlad_komarov — Thu, 01 Oct 2015 18:47:55 GMT

Alexander,

Спасибо, надеюсь на Ваши советы:

Few initial questions (seems to be related to Ruben's post, so I am keeping them here):

1. Why do we need a Custom security rule if we do have "default" one (CreateAppObjectsPublishedApp):

It contains the condition for resource.objectType = "sheet", and is seems to allow it's creation for (user.@role="RootAdmin" or user.@role="ContentAdmin") only.

Did not work in my case. All users, who were not set as Admins were able to create a new sheet and other objects

2. I've created my custom rule in order to restrict users from creating the new sheet in the specific stream of Published apps only using the following:

App_*, App.stream.name="Brand #1".

I've left the [App_*] there initially.

Does this mean that it applies to all Apps and ignores Apps located in "Brand #1" stream? It looks like it based on my testing...

General questions:

1. Order of rules execution: How QS is handling "similar" rules - applicable to the same resource, for example? Is it executing the system rules first and custom later?

Or they are excluding each other. Just trying to understand why we need to disable a "default" rule when we are creating a custom one?

Appreciate your help. Looking forward to your reply.

Regards,

Vladimir

Re: Disabling "Create new sheet" and other options

rubenmarin — Fri, 02 Oct 2015 06:50:37 GMT

Hi Vladimir, in a recently installed server, the default rule looks like this:

In your post on 29-sep-2015 22:32 in this thread looks like you changed the rule.

Meanwhile the ContentAdmin rule look like this:

This is the way Sense server uses admin roles

Re: Disabling "Create new sheet" and other options

vlad_komarov — Mon, 05 Oct 2015 22:35:27 GMT

Alexander,

One more (kind of on-topic question): Could you please comment on the following post:

Unable to allow a "Duplicate" option

Regards,

Vladimir

Re: Disabling "Create new sheet" and other options

AKANKSHA2 — Fri, 05 Aug 2022 06:12:55 GMT

Initially am new to qliksense ,can you pls help out that how to hide or restrict create new sheet from sheets and selections option too ....

Thanks &regards

Akanksha