article Qlik Sense for Windows: How to allow task reloads on the Hub in Official Support Articles

Qlik Sense for Windows: How to allow task reloads on the Hub

John_Sathya — Wed, 31 May 2023 07:11:36 GMT

Security Rules can be configured to allow end-users to reload tasks directly from the Qlik Sense Hub. This way the users who don't have access to Qlik Sense Management Console can run the tasks that are created for the app directly from the hub.

Environment

Qlik Sense February 2021 & later (For "Manage reload tasks": start/stop existing tasks from the hub)
Qlik Sense May 2021 & later (An addition to "Reload": create tasks from the hub)

Security Rule examples are provided as-is. Further customization cannot be supplied by Qlik Support and we recommend engaging with our active community in the Qlik Sense Management forums for further assistance.

Requirements and Considerations

By default, a user will have Read and Update permissions on Apps they own, whether they are Published or not.
If you intend to give users permission to reload a published App they do not own, a separate security rule will be necessary to enable Read and Update permissions on the App.
A Professional License. Analyzer licenses will only be able to view tasks, even with the security rules in place.
By default, all users have access to the required HubSection_Task. This is the starting point to allow users to reload from the hub. If custom rules have been implemented that block access to HubSection_Task, this needs to be lifted or customised.

Note: Too many tasks run in parallel by users can cause a performance impact.

Set up the Security Rules:

Open the Qlik Sense Management Console
Go to Security Rules in the left side menu
Click Create New
Set up either a for only managing existing tasks only or b for creating new tasks and managing existing tasks:
1. Start and Stop existing Reload Tasks only
  
  Name: Reload Access from Hub (example)
  Description: Allows users to reload apps from the hub (example)
  Resource filter: ReloadTask_* (Can be chosen from the dropdown menu next to the box)
  Actions: Read, Update
  Conditions: Specify your user or group or role.
2. Create a new Reload Task and launch it as well as manage existing tasks
  
  Name: Reload Access from Hub (example)
  Description: Allows users to create reloads from the hub (example)
  Resource filter: ReloadTask_* (Can be chosen from the dropdown menu next to the box)
  Actions: Read, Update, Create
  Conditions: Specify your user or group or role.
Apply both rules

The specified users can now right-click on the hub to access the Management Reload Task (rule a) or/and Reload option (rule b). See Fig 1.

Fig 1

Clicking Reload to initiate the reload and open the App in a new tab.

Clicking Manage reload tasks to access all available reload tasks for this App. Tasks can then be started (Fig 2) or stopped (Fig 3)from this menu.

Fig 2

Fig 3

Additional Notes:

Giving access to the Apps will always expose the Manage Properties option.

This can be mitigated by modifying the existing ReadCustomProperties rule to fit your needs. However, this will not hide the Manage Properties option.
Giving Update permissions to users allows them to edit the App's name, description, and thumbnail. This is working as expected.

Re: Qlik Sense for Windows: How to allow task reloads on the Hub

Ken_T — Mon, 19 Jul 2021 14:26:30 GMT

Was this fully tested?

in my testing, this allows users to also be able to view the load script for published tasks and reload published tasks from the hub, which seems like a very, very bad idea for system stability.

is there any way to implement this new feature without allowing the user to change the load script on a published task?

Re: Qlik Sense for Windows: How to allow task reloads on the Hub

Sonja_Bauernfeind — Mon, 19 Jul 2021 14:32:19 GMT

Hello @Ken_T

Yes, this was fully tested.

And thank you so much for the feedback! Always appreciated 🙂

I'll take the feedback on access to the script to our SMEs to see if we can provide a workaround (tightening of security rules) or if this is considered working as designed. Will update the article and reply to you once I finished the testing.

All the best,

Sonja

Re: Qlik Sense for Windows: How to allow task reloads on the Hub

Ken_T — Mon, 19 Jul 2021 14:38:42 GMT

Thanks @Sonja_Bauernfeind ! I was not able to get it to work without exposing theload script and reload button for a published task. (That seems a very good way to cause issues if a user is changing something the system expects to be locked for changes ) - Hopefully a workaround can be found. We were excited about this functionality when we first found it, but, after testing it, and logging a support ticket, we had to decide to plan to not implement it.

Re: Qlik Sense for Windows: How to allow task reloads on the Hub

Sonja_Bauernfeind — Thu, 22 Jul 2021 09:28:58 GMT

Hello @Ken_T!

This is now with our developers. Will keep you informed in this article once we have a proper conclusion.

-Sonja

PS: Keep the feedback coming 🙂

Re: Qlik Sense for Windows: How to allow task reloads on the Hub

Or — Mon, 26 Jul 2021 12:39:30 GMT

@John_Sathya @Sonja_Bauernfeind

Follow up question regarding this specific instruction:

"If you intend to give users permissions to reload a published App, a separate security rule will be necessary to enable Read and Update permissions on the App."

What exactly will a user be able to do (other than run reload tasks) if they are given update permissions on a published app? I'd like to allow them to run reload tasks from hub, but I don't want them making any changes to the underlying app...

Thanks!

Re: Qlik Sense for Windows: How to allow task reloads on the Hub

Or — Mon, 16 Aug 2021 14:30:21 GMT

@John_Sathya @Sonja_Bauernfeind

Attempting to answer my own question here, but still hoping for an official response...

Giving a user UPDATE access to App_* for published apps appears to allow them to change the app name or description, which obviously isn't feasible just to allow someone to reload the app. Unless there's a more specific property that we should be setting the security rule on, this means allowing users (or administrators) to reload published tasks from the hub isn't feasible. Assuming this is indeed the case, it's quite unfortunate as allowing task runs from the hub would have been great if it actually worked outside of one's own Work stream.

Hopefully there's a property out there that will allow reloads of published apps without allowing users to change important aspects of the app, or there are plans to introduce a solution for this in a near-future version. As it stands, the only available option is to continue using QMC to reload apps (as users can't break anything related to the app if you only give them access to the Tasks section and make the rule QMC-only).

Re: Qlik Sense for Windows: How to allow task reloads on the Hub

Sonja_Bauernfeind — Tue, 17 Aug 2021 06:15:32 GMT

Hello @Or

We'll add your question to our query with our developers around this! Thank you for getting in touch.

Re: Qlik Sense for Windows: How to allow task reloads on the Hub

lblancher — Wed, 18 Aug 2021 01:24:18 GMT

@John_Sathya @Sonja_Bauernfeind

Thank you for the information on this, however, I would like to echo the comments of @Or that giving a user the Update permission on a published application is not good. I'm excited (and subscribed) to find out what you hear from the development team about how to work around this limitation.

Regards,

Lucas

Re: Qlik Sense for Windows: How to allow task reloads on the Hub

Sonja_Bauernfeind — Wed, 01 Sep 2021 13:22:08 GMT

Hello all!

The article was updated.

@Ken_T Ken, we've tested this in-house and based on the above rules, the end-user does not have access to the script. They can see the Data Model, but will not be able to see or edit the script. You may have other rules in place that are in addition to giving more access. I would recommend posting about this in our forums.

My testing included two rules: The Reload rule and a single Update all Apps rules for a user named User 1. User 1 was then able to reload the app, manage reloads, edit the name/thumbnail/description, and see the Data Model. But no reload script.

@Or @lblancher The update permissions are required. I got more feedback on how to prevent an update of the properties, but the thumbnail, description, name, etc are baked into the Update functionality.

I would suggest logging an idea for this to see what our devs can do about improving this experience.

All the best,
Sonja

Re: Qlik Sense for Windows: How to allow task reloads on the Hub

Or — Thu, 02 Sep 2021 13:50:36 GMT

@Sonja_Bauernfeind Thanks for getting this looked at and providing the relevant information. This does unfortunately mean that reload-from-hub isn't an option for me at the moment, but it's good to have confirmation. Luckily, reload-from-QMC is still working without allowing users to change any app information, so we'll stick to that option.

Re: Qlik Sense for Windows: How to allow task reloads on the Hub

mbespartochnyy — Fri, 03 Sep 2021 14:52:15 GMT

It looks like this isn't working well with custom properties.

THE SETUP

CUSTOM PROPERTY

I've created a custom property called ReloadFromHubAllowedApps to be used on Users. Inside the ReloadFromHubAllowedApps custom property I added TestApp value, name of the app that I will want a user that is not an owner of that app to be able to reload from the Hub:

THE USER

Next, I've assigned the TestApp value in ReloadFromHubAllowedApps custom property for the test user, indicating that this user should be able to reload app called TestApp from the Hub:

THE APP

Lastly, I then created and published an app called TestApp to a stream, granted test user permission to the TestApp app, confirmed that the test user can see and access the app:

THE TASK

Last stop, the task for the TestApp app:

At this point, TestApp app is created and published, reload task is created, test user is permitted access to that app and configured to be able to reload the app called TestApp from the hub. So the user can see and access the app, but can't reload it yet. That's where security rules come in.

SECURITY RULES

Next I setup two security rules.

RULE 1: UPDATE APPS PERMISSION

First rule allows users Update published apps that they don't own so that they would be able to execute the reload:

This rule allowed the user to manage app's properties, edit app's name, description, and thumbnail, and see the data model:

So this rule worked fine.

RULE 2: RELOAD TASKS PERMISSION

The other rule, would grant access to reload tasks that belong to apps that user was permissioned to be able to reload using the ReloadFromHubAllowedApps custom property:

Fairly straightforward. Just for the heck of it, I hit the Preview button to confirm that the rule does impact the right user and the right task, which it does:

However, this rule doesn't work. When rule is created and saved and test user refreshes the Hub, that user still doesn't have access to the Manage reload tasks menu:

TROUBLESHOOTING

I went ahead and confirmed that the HubSectionTask rule is enabled:

After confirming that HubSectionTask is enabled and setup correctly, I've modified the Rule # 2 to see if it would work if the rule was more general:

Making the rule more general did make the Manage reload tasks option available for the test user:

The option to execute reload of the task for the app was also available:

That points to the issue being some bug somewhere with ReloadTask.app.name is not matching successfully to user.@ReloadFromHubAllowedApps custom property even though the security rule preview indicates that such rule should properly allow test user to manage task in the hub for the TestApp app.

I like this feature but if I can't dynamically and precisely control which users can see reload tasks to which app without having to create rules for each user and app and, in addition to that, as @Or and @lblancher mentioned, having to give users Update permissions to the app, it makes this user not very usable.

Please look into why custom properties are not working well and please keep us posted if you'll ever resolve the issue with having to give users Update rights to the app in order to have users be able to execute reloads from the Hub.

Thanks,

Mikhail B.

Re: Qlik Sense for Windows: How to allow task reloads on the Hub

mbespartochnyy — Wed, 15 Sep 2021 21:05:23 GMT

I did a bit more testing on this and found out that the issue may not be in custom properties but rather in resource.app portion of the advanced condition.

It looks like even if I make advanced condition of Reload Tasks From Hub Access security rule as simple as ((resource.app.name="TestApp")), it still won't allow users access to tasks associated with specified app (app named TestApp in this example).

I am hoping that Qlik devs will fix this as it makes security rules for ReloadTask resources less dynamic and require more overhead to administer.

Re: Qlik Sense for Windows: How to allow task reloads on the Hub

voitijaner — Tue, 05 Oct 2021 11:48:48 GMT

@John_Sathya @Sonja_Bauernfeind

We face the same issue as @mbespartochnyy .

The management with a Custom App-Property to allow a dynamic user group to perform reloads from the hub for specific apps is not possible right now. Is this an intended behavior?

Re: Qlik Sense for Windows: How to allow task reloads on the Hub

Sonja_Bauernfeind — Wed, 06 Oct 2021 12:14:01 GMT

Hello @voitijaner and @mbespartochnyy

I've forwarded this to our SMEs! Will keep you posted.

Re: Qlik Sense for Windows: How to allow task reloads on the Hub

Sonja_Bauernfeind — Wed, 06 Oct 2021 12:28:45 GMT

Hello again @voitijaner and @mbespartochnyy

We'd recommend for one of you to log a detailed feature request/idea here: Suggest and Idea.

Outline your requirements as best as you can and let me know when you've done so, so that I can go and give it a vote.

Re: Qlik Sense for Windows: How to allow task reloads on the Hub

mbespartochnyy — Wed, 06 Oct 2021 13:43:21 GMT

Hi @Sonja_Bauernfeind,

It's not quite a new idea. Using custom properties to dynamically manage permissions already exists. It just looks to be broken when applied specifically to task reloads.

And again, custom properties is not the problem here. Based on my tests that I've described above, the issue seems to be with resource.app portion of advanced conditions.

This part:

#ReloadTask.app part doesn't work. You can create a rule that says "give reload permissions for tasks that belong to app named TestApp" and users will still not be able to access reload tasks for specified app.

That's the problem. Someone needs to look into why ReloadTask.app being set to name and value being set to name of an app doesn't actually give users permissions to access reload tasks of specified app.

Give that a try. Create and publish an app called TestApp, create a reload task for that app, give user permission to the app, and create a security rule that gives user permission to reload task of an app named TestApp, and a security rule that gives user permission to update TestApp. You will see that even though you gave user permission to update the app and reload tasks for TestApp, user will still not be able to see reload tasks of TestAppin the hub. That's the bug that needs to be fixed. It's not a new idea or a feature.

Did that help to make it clearer?

Re: Qlik Sense for Windows: How to allow task reloads on the Hub

mountaindude — Thu, 17 Feb 2022 17:27:38 GMT

tldr
This is pretty complex stuff... Previous writers have captured the gist of things, but I might be able to add some clarity too.

You can get this to work, but there's not a lot of flexibility and the end user experience is so-so.
Not possible (from what I've seen so far - might revise that after diving deeper into the app object security rules) to conditionally hide the "Manage properties" menu item in the right-click menu.
The "Manage properties" popup window can be made read-only. But that's a lousy user experience.

Long version
As hinted (but not clearly stated) in point 4.b in the original post you must give CR permissions to ReloadTask_* (or ReloadTask_<taskid>) to make the "Reload" and "Manage reload tasks" appear when right clicking on an app in the hub.

Clicking Reload will do one of two things:
1. If a manual reload task already exists it will be started.
2. If such a reload DOES NOT exist it will first be created, then started.

Either way the app is reloaded.

If clicking "Manage reload tasks" you get a popup window show the tasks associated with the app. If a specific task filter was used in the reload task security rule (i.e. filter ReloadTask_<taskid>) you will only see that task.

The above assumes that the current user also has U permission to the app that was right-clicked in the hub. From what I can see Update permissions are enough to trigger a reload from the hub, even though the original article mentioned R permissions too. Might be worth looking into.

What needs fixing

Better/more fine-grained control of what is shown when right-clicking an app in the hub. I.e. control which of "Reload", "Manage reload tasks" and "Manage properties" is displayed.
A proper, solid tutorial in how to set things up. @mbespartochnyy has most parts covered but updates needed when point above has been fixed.

Re: Qlik Sense for Windows: How to allow task reloads on the Hub

mountaindude — Thu, 17 Feb 2022 21:49:38 GMT

After digging around the various security rules that affect how app reloads (don't) work in the hub I've come to the conclusion that it can be done, but the user experience is not optimal.

I put together a video showing what it looks like, plus my personal views why this should be improved.
Who knows - we may even be able to tweak things using other/better security rules - or Qlik has to change things under the hood. Time will hopefully tell.

https://youtu.be/5dYOZc6tmT4

---------------------------------
Göran Sander
YouTube channel with Qlik Sense DevOps videos here.
Open source DevOps tools for Qlik Sense here.

Re: Qlik Sense for Windows: How to allow task reloads on the Hub

NickSPH — Thu, 01 Sep 2022 09:51:40 GMT

Hi,

I've created a Support Case (#00049953) as we are having the exact same issue. A security rule using #ReloadTask.app does not seem to be working correctly. Thank you @mbespartochnyy for your thorough investigation into the issue!

Support was VERY helpful with escalating this issue to the proper department at Qlik (even though this seems to be a possible product defect), as they only 'have limited options to assist when it comes to the topic of security rules'. They do however 'have notified the Team about it and our experts will follow on the post'.

Let's hope someone who can help at Qlik will notice and follow up properly to resolve the issue!