Enable restricted people to publish on a Stream

[assa]

Hello,

I would like to create a Stream on which somes people have a custom properties, are able to publish on it. 

First, I have create a custom properties:

After that, I have attibute, the custom properties for the QlikSense user who have to be access on the stream and publish on that:

 

then, I have create the stream and add the custom properties without security rules with id of the stream. 

I have created this security rules to permit people who have the custom properties to read and publish on the stream:

When I make an audit the user have the read and publish right

 

The user see the stream and the apps on it but it can't publish an app on it. 

 

 

Can you help me please and tell me what is wrong on my security rules? 

Thanks 

[howdash]

There are two issues. One with the condition of the security rule and the other with the way the custom property is designed and used.

Here's what you will need to do to allow users to publish to specific streams.

Step 01.

Create a new custom property that will hold names of streams where users can publish apps.

Step 02.

Select Users as resource type.

Step 03.

In Values section, click Create new.

Step 04.

Enter the name of a stream where you would like users to publish apps. The name must match stream name.

Step 05.

If you have other streams where you would like the user to publish apps, click the Create new button again and add name of additional streams.

Step 06.

Click Apply to create PublishToStream custom property.

Step 07.

Select the user that needs to be able to publish to a stream and assign the name of the stream where user should be able to publish apps to in the PublishToStream custom property.

Step 08.

Create a new security rule that will allow user to publish to whichever steam is listed in the PublishToStream custom property with this condition:

((user.@PublishToStream=resource.name))

With this custom property and security rule, the user will be able to publish to whichever stream that you specify in the PublishToStream custom property:

Qlik Sense Security Course

I created a whole course on Qlik Sense security where I share how to create dynamic, scalable, and easy to manage security rules, like this one and many others, to help you manage your Qlik Sense server and resources at scale. You can check it out here:

https://www.howdash.com/courses/qlik-sense-security

[assa]

Hello, 

Thanks Howdash for your help 🙂 

I have make follow step by step your process but the user still can't publish on the stream. 

I'm thinking about something else: it's possible that another security rules takes precedence over another rule?

Because, I see that I have another security rules allow only Functional Manager to publish on stream. 

[howdash]

No, other security rules won't interfere. Qlik Sense security rules are permissive only. Meaning, a security rule cannot restrict someone from publishing to a stream.

I think the issue might be my fault. I just noticed that in the steps above I named the new custom property PublishToStreams whereas the security rule that I referenced uses custom property name that is PublishToStream.

The correct custom property name should be PublishToStream. I've updated my initial reply to reference correct custom property name.

Can you please check the name of the custom property that you have created? The name of the custom property should match the name used in the security rule.

[assa]

Thanks 🙂 but I have see the difference before and I have correct it and I still don't have the right to publish apps on the stream 😞 

[howdash]

That's odd. Can you please share a screenshot of the new custom property that you've created and a screenshot of the new security rule?

Also, can you share a screenshot showing the stream name where you would like the user to publish apps and a screenshot of the user profile with the custom property value assigned?

[assa]

Hello, thanks again for your help. There are the screenshot that you asking for: 

 

 

 

 

[howdash]

Huh...that's strange. That setup (custom property + security rule) allows user to publish to specified stream. There really is nothing that should be preventing the user from publishing to specified stream with that rule and custom property in place.

I imagine the user has refreshed the Hub page. Maybe they need to clear their browser's cache?

If clearing browser's cache won't work, I would try making a rule that will allow that user to have unrestricted permission to publish to every stream (that is if you trust the user to not do anything malicious) and see if the user will be able to publish then. You can try a rule like this:

This will allow specified user to read and publish to all streams.

You can also, do something on a smaller scale and allow the user to publish to a specific stream by referencing stream's ID. Like this:

This will allow specified user to access and publish to specified stream.