[QlikCloud] Modifying auto-assignments of user’s roles by REST API

sanekagr2 — Wed, 31 Jan 2024 17:26:50 GMT

Hello

For the creation of new basic users instead of full users I have to cancel some auto-assignments of user’s roles (Data Services Contributor, Private Analytics Content Creator or Shared Space Content Creator), it can be found here: https://{tenant-name}.eu.qlikcloud.com/console/users/permissions

Is there a way to do it by the API?

Re: [QlikCloud] Modifying auto-assignments of user’s roles by REST API

Vincenzo_Esposito — Thu, 01 Feb 2024 08:53:56 GMT

You should be able to do it using qlik-cli. Look this help page

https://qlik.dev/toolkits/qlik-cli/user/user-edit/

Re: [QlikCloud] Modifying auto-assignments of user’s roles by REST API

Dave_Channon — Thu, 01 Feb 2024 13:24:04 GMT

Hi @sanekagr2

Have a look at https://qlik.dev/manage/tenants/tenant-features/#configure-application-automation - there is an example of removing the automatic access to app automation from the everyone group there.

Or are you referring to individually assigned roles? If so, that's a very similar process, but running the update on the user with a similar command using a user patch https://qlik.dev/apis/rest/users/#%23%2Fentries%2Fv1%2Fusers%2F-userId-patch

Re: [QlikCloud] Modifying auto-assignments of user’s roles by REST API

sanekagr2 — Thu, 01 Feb 2024 15:15:03 GMT

Thank You, Can I change tenant permissions settings via CLI, or is it only possible on the user level.

Re: [QlikCloud] Modifying auto-assignments of user’s roles by REST API

sanekagr2 — Thu, 01 Feb 2024 15:30:48 GMT

I prefer to change the tenant auto assigning settings but if it's not possible I can change the user type from full to basic, is it possible by PATCH users?

Re: [QlikCloud] Modifying auto-assignments of user’s roles by REST API

Dave_Channon — Fri, 02 Feb 2024 10:18:51 GMT

@sanekagr2 If you're using a capacity entitlement (e.g. full/basic rather than professional/analyzer), then the users will be set as a full user if they have specific roles. Which roles are being auto assigned to those users directly?

In any case, you can PATCH the users to remove any roles you don't require, yes.

Let me provide an example, this call:

curl --location "https://orchestration.eu.qlikcloud.com/api/v1/users/65bcc053fca2ee34855adf24" ^ --header "Authorization: Bearer " ^ --header "Content-type: application/json" ^ --header "Accept: application/json"

Will return for that user their user data:

{ "id": "65bcc053fca2ee34855adf24", "tenantId": "BL4tTJ4S7xrHTcq0zQxQrJ5qB1_Q6cSo", "status": "active", "subject": "auth0|a08D000001F0WJRIA312", "name": "A new user to demonstrate roles", "email": "myemail@qlik.com", "roles": [ "Developer" ], "assignedRoles": [ { "id": "608050f7634644db3678b1a2", "name": "Developer", "type": "default", "level": "user" } ], "assignedGroups": [ { "id": "000000000000000000000001", "name": "com.qlik.Everyone", "assignedRoles": [ { "id": "6356f0425cf9728f1962b95c", "name": "Steward", "type": "default", "level": "user" }, { "id": "63580b8d5cf9728f19217be0", "name": "PrivateAnalyticsContentCreator", "type": "default", "level": "user" }, { "id": "605a1c2151382ffc836af862", "name": "SharedSpaceCreator", "type": "default", "level": "user" }, { "id": "6467dcd960754c03a3ed402c", "name": "AutomationCreator", "type": "default", "level": "user" }, { "id": "6356f0425cf9728f1962b942", "name": "DataServicesContributor", "type": "default", "level": "user" }, { "id": "605a1c2151382ffc836af86b", "name": "DataSpaceCreator", "type": "default", "level": "user" }, { "id": "608050f7634644db3678b1a2", "name": "Developer", "type": "default", "level": "user" }, { "id": "605a1c2151382ffc836af866", "name": "ManagedSpaceCreator", "type": "default", "level": "user" }, { "id": "64de70c1cce069297e919393", "name": "AutomlExperimentContributor", "type": "default", "level": "user" }, { "id": "64de70c1cce069297e919406", "name": "AutomlDeploymentContributor", "type": "default", "level": "user" } ] } ], "createdAt": "2024-02-02T10:13:39.799Z", "lastUpdatedAt": "2024-02-02T10:15:45.156Z", "created": "2024-02-02T10:13:39.799Z", "lastUpdated": "2024-02-02T10:15:45.156Z", "links": { "self": { "href": "https://orchestration.eu.qlikcloud.com/api/v1/users/65bcc053fca2ee34855adf24" } } }

This shows that they have assigned a single role directly, the 'Developer' role. But they have a lot of roles through the Everyone group.

To remove ALL individually assigned roles:

curl --location --request PATCH "https://orchestration.eu.qlikcloud.com/api/v1/users/65bcc053fca2ee34855adf24" ^ --header "Authorization: Bearer " ^ --header "Content-type: application/json" ^ --data "[ { \"op\": \"replace\", \"path\": \"/assignedRoles\", \"value\": [] } ]"

Now the user looks like this:

{ "id": "65bcc053fca2ee34855adf24", "tenantId": "BL4tTJ4S7xrHTcq0zQxQrJ5qB1_Q6cSo", "status": "active", "subject": "auth0|a08D000001F0WJRIA312", "name": "A new user to demonstrate roles", "email": "myemail@qlik.com", "roles": [], "assignedRoles": [], "assignedGroups": [ { "id": "000000000000000000000001", "name": "com.qlik.Everyone", "assignedRoles": [ { "id": "6356f0425cf9728f1962b95c", "name": "Steward", "type": "default", "level": "user" }, { "id": "63580b8d5cf9728f19217be0", "name": "PrivateAnalyticsContentCreator", "type": "default", "level": "user" }, { "id": "605a1c2151382ffc836af862", "name": "SharedSpaceCreator", "type": "default", "level": "user" }, { "id": "6467dcd960754c03a3ed402c", "name": "AutomationCreator", "type": "default", "level": "user" }, { "id": "6356f0425cf9728f1962b942", "name": "DataServicesContributor", "type": "default", "level": "user" }, { "id": "605a1c2151382ffc836af86b", "name": "DataSpaceCreator", "type": "default", "level": "user" }, { "id": "608050f7634644db3678b1a2", "name": "Developer", "type": "default", "level": "user" }, { "id": "605a1c2151382ffc836af866", "name": "ManagedSpaceCreator", "type": "default", "level": "user" }, { "id": "64de70c1cce069297e919393", "name": "AutomlExperimentContributor", "type": "default", "level": "user" }, { "id": "64de70c1cce069297e919406", "name": "AutomlDeploymentContributor", "type": "default", "level": "user" } ] } ], "createdAt": "2024-02-02T10:13:39.799Z", "lastUpdatedAt": "2024-02-02T10:17:16.502Z", "created": "2024-02-02T10:13:39.799Z", "lastUpdated": "2024-02-02T10:17:16.502Z", "links": { "self": { "href": "https://orchestration.eu.qlikcloud.com/api/v1/users/65bcc053fca2ee34855adf24" } } }

To remove the roles inherited from the everyone group, you need to remove that from that group, per the guide in my previous link.

Re: [QlikCloud] Modifying auto-assignments of user’s roles by REST API

sanekagr2 — Sun, 04 Feb 2024 21:55:43 GMT

It solved the problem, PATCH of the everyone group canceled auto-assigned roles

, thanks.

curl --location --request PATCH 'https://<tenant>.eu.qlikcloud.com/api/v1/groups/000000000000000000000001' \ --header 'Authorization: Bearer ^' \ --header 'Content-Type: application/json' \ --data '[ { "op": "replace", "path": "assignedRoles", "value": [] } ]'

Re: [QlikCloud] Modifying auto-assignments of user’s roles by REST API

Dave_Channon — Mon, 05 Feb 2024 13:05:58 GMT

Great, thanks for the update @sanekagr2 !

topic Re: [QlikCloud] Modifying auto-assignments of user’s roles by REST API in Integration, Extension & APIs

[QlikCloud] Modifying auto-assignments of user’s roles by REST API

Re: [QlikCloud] Modifying auto-assignments of user’s roles by REST API

Re: [QlikCloud] Modifying auto-assignments of user’s roles by REST API

Re: [QlikCloud] Modifying auto-assignments of user’s roles by REST API

Re: [QlikCloud] Modifying auto-assignments of user’s roles by REST API

Re: [QlikCloud] Modifying auto-assignments of user’s roles by REST API

Re: [QlikCloud] Modifying auto-assignments of user’s roles by REST API

Re: [QlikCloud] Modifying auto-assignments of user’s roles by REST API