topic Re: How to prevent access to the hub? (3.1.2) in Management & Governance

How to prevent access to the hub? (3.1.2)

Thu, 24 Nov 2016 13:40:37 GMT

With the Service Release 2 for Qlik Sense 3.1 the release notes mention the new ability

Support for disabling user access to the hub Resource filters can be used to restrict user access to the hub.

How can this be achieved? I figured a new security rule 'HubSections', but no matter whether I left it to true or changed it to false, it wouldn't make the hub behave differently at all. Has anybody more information on this topic?

Thanks alot

Thomas

Re: How to prevent access to the hub? (3.1.2)

korsikov — Thu, 24 Nov 2016 16:02:16 GMT

I am also very interested in this issue

Re: How to prevent access to the hub? (3.1.2)

pascal_theurot — Thu, 24 Nov 2016 17:57:46 GMT

Re: How to prevent access to the hub? (3.1.2)

markginqo — Fri, 25 Nov 2016 01:01:34 GMT

++1

Re: How to prevent access to the hub? (3.1.2)

lakshmikandh — Fri, 25 Nov 2016 11:23:03 GMT

Re: How to prevent access to the hub? (3.1.2)

Anonymous — Mon, 28 Nov 2016 10:02:14 GMT

Me tooooo want to know about this feature as this is very important in restricting access to hub and show the apps

Re: How to prevent access to the hub? (3.1.2)

lakshmikandh — Tue, 29 Nov 2016 11:46:16 GMT

mto‌ Hi Mike, can you guide us how to do this ?

Re: How to prevent access to the hub? (3.1.2)

Michael_Tarallo — Tue, 29 Nov 2016 14:23:42 GMT

Hi Guys - looking into it. I will have something or somebody available with info on this.

Regards,

Mike Tarallo

Qlik

Re: How to prevent access to the hub? (3.1.2)

Michael_Tarallo — Wed, 07 Dec 2016 18:42:07 GMT

Hi Thomas,

I got some more information on this, - this setting basically just acts like an ON/OFF switch and nothing more. It does not control access to certain sections of the hub, similar to what the QMC resource filter would do.

Let me know if you need more info.

When applicable please mark the appropriate replies as CORRECT. This will help community members and Qlik Employees know which discussions have already been addressed and have a possible known solution. Please mark threads as HELPFUL if the provided solution is helpful to the problem, but does not necessarily solve the indicated problem. You can mark multiple threads as HELPFUL if you feel additional info is useful to others.

Regards,

Michael Tarallo (@mtarallo) | Twitter

Qlik

Re: How to prevent access to the hub? (3.1.2)

markginqo — Thu, 08 Dec 2016 20:42:04 GMT

Thanks for looking into this, Michael. I think the problem we are having is that the security rule does not seem to have any effect. Could you see if you can find us a condition that would do something like block access to the Hub for a particular user or AD group?

Thanks again,

Mark

Re: How to prevent access to the hub? (3.1.2)

Fredrik_Lautrup — Fri, 09 Dec 2016 08:00:43 GMT

Current implementation is limiting in that it will not limit access to the hub but it will remove the link from the app back to the hub.

So if you change the rule "HubSections" condition to something like

user.group="NoHubAccess"

This would mean that for the users in the group NoHubAcces the link from the app back to the hub will disappear.

In most use cases I think this would be enough, but if there are needs to limit access to the hub it would be good to understand these cases if we need to make improvements in the future.

Re: How to prevent access to the hub? (3.1.2)

markginqo — Mon, 12 Dec 2016 17:45:26 GMT

Thanks Fredrik, I can confirm that the flag does remove the link back to the hub from an App.

We are looking into this feature because one of our installations is used to host branded Mashups exclusively and by entering only the domain name an unsuspecting user can launch the Hub.

Ideally I would like to see a few more features typical to web servers available for cases where the client does not also want to run an IIS instance:

Override default directory - so root directory can be used to serve static HTML content
Custom names/locations for subdirectories - having to use "/extensions/" in the mashup path name makes for unwieldy URLs
"index.html"-style default document - so the user does not have to specify the full file name in a Mashup URL
Hostname-based routing - so we could use dev.domain.com for a virtual proxy instead of domain.com/dev/
Redirect port 80 (HTTP) requests to port 443 (HTTPS)
Allow editing of HTML for Forms authentication pattern page
Mod_Rewrite style URL mapping

Cheers,

Mark

Re: How to prevent access to the hub? (3.1.2)

Wed, 14 Dec 2016 10:03:45 GMT

Thanks for the explanation on this.

Also this new short video will help, I think: Disabling the hub ‒ Qlik Sense

Re: How to prevent access to the hub? (3.1.2)

Maria_Halley — Fri, 13 Jan 2017 09:11:27 GMT

I have tested this (in 3.1.4) and it seems like changing the rule like this would turn ON access to the hub for the group "NoHubAccess".

The default rule is granting access to all users. So shouldn't the rule be user.group!="NoHubAccess"?

Or am I misunderstanding?

Re: How to prevent access to the hub? (3.1.2)

Fredrik_Lautrup — Tue, 21 Feb 2017 10:26:23 GMT

You should not add to but replace the behaviour of the default rule. Changing the condition on the default rule would mean that only those matching the condition would get access.

Re: How to prevent access to the hub? (3.1.2)

EmmaC — Tue, 26 Sep 2017 08:04:15 GMT

Dear Mark,

You couldnt have summarized it better! I would like to see all those features! None of them are ready? June 2017? September 2017?

Any updates?

Re: How to prevent access to the hub? (3.1.2)

markginqo — Tue, 26 Sep 2017 16:47:45 GMT

Hi Emma,

I don't think that these type of features have made it into the product yet. I believe some folks are using nginx or IIS to achieve them if it is critical (and your budget doesn't allow for a more robust solution like F5 or a web application firewall)...

Cheers,

Mark

Re: How to prevent access to the hub? (3.1.2)

EmmaC — Wed, 27 Sep 2017 06:53:09 GMT

Qlik support answered my ticket, and yes, these features are out of the scope (i wanted to open a feature request! No chance!)

regards,

Emma

Re: How to prevent access to the hub? (3.1.2)

markginqo — Wed, 27 Sep 2017 15:17:59 GMT

Thanks for sharing that information, it's good to have confirmation so we can proceed with alternate solutions. I think it makes sense, to an extent, to leverage products that have been specifically designed to tackle these issues.

Cheers,

Mark

Re: How to prevent access to the hub? (3.1.2)

berndjaegle — Tue, 04 Jun 2019 08:32:15 GMT

We could achieve it with the on-bord instruments: Block user.

All our users have CustomProperty @UserTyp (Consumer, Analyst, Contributor) which we implemented to assign security rules. However with this CustomProperty I can select all users I want to block.

Press Edit(multiple) an tick the BLOCKED check box.

Done.

Be careful to 'Clear filters and search' before editing onwoards...

Best regards,

Bernd