REST connector PaySpace - hide credentials

[erhardt_dekock]

Hello

We have integrated with PaySpace (Salary and employee data) using a Soap REST connector.

The data connector uses * as username and password just to have the connection setup.

The real credentials used for this connector is contained in the Body, which is in the script of the app.

We have section access setup to the app, which protects the credentials in the script.

The issue is that these credentials show in the log file once reloaded, which is then visible to all developers.

Is there a way to encrypt these credentials or hide them?

Any suggestions are welcome

[Gysbert_Wassenaar]

I don't understand your problem. Section Access has zero influence on who gets to see what's in the script or not. If your developers have access to the load script then they can see anything that's in the script. They won't need to see the reload logs for that. So, I don't understand what your describing. Could you explain?

[erhardt_dekock]

Without being included in the section access you can not see the script of an QlikSense app. The developers who are not suppose to see the script is not included in the section access. Even if they duplicate the app, they won't be able to open it.

[Gysbert_Wassenaar · Accepted solution]

Sorry, but that's incorrect.  If you can duplicate the app you can always open the app without data and then you can see the script.

[erhardt_dekock]

Excellent to know Gysbett, thank you.
Will have a chat to our Qlik Partner in the new year. Have removed the app from the QMC for now.
Still looking for a solution, but will create another post.

[Gysbert_Wassenaar]

It's really very simple. If you don't trust your developers then don't give them access to the data. Create a separate app that loads the data, anonymizes the data and store that data in qvd files. Then let your developers create apps using only the anonymized data. When they're done developing you can take those apps away from them and load them with real data. Make sure those untrustworthy developers can't duplicate those apps.

[BogiG]

@erhardt_dekock did you find solution for your problem?
@Gysbert_Wassenaar - Thank you for suggestion. I'm also looking for the way to hide password and username in the rest connection. When using it with "with" parameter. 
If there is a way to hide this form log and also form qvd File Metadata. I know that there is possibility to turn off linage - but not per app. So I wonder if in the scenario you propose developers can find username and password in qvd linage data. (Maybe storing data into parquet instead qvd will be solution for that).