On a QSEoW multi-node environment, how to eliminate access to the Personal area folders to users with Professional license?

[diagonjope]

Greetings!

I am setting-up a QSEoW environment with two nodes.  The idea is to use the CENTRAL node as a production node with all services running, and use the RIM node for reloads and development.

I want to restrict Professional users from even seeing the QVFs in their Personal area (Work and Published) when accessing the CENTRAL node for consumption through the default virtual proxy - so that they can't consume resources in the CENTRAL node for apps in development; as well as restricting anyone from seeing production apps in the RIM node. 

I already have another virtual proxy and load balancing rules set up to use the engine in the RIM node for development, so that when the users with Professional license use the /dev prefix they will end-up in the RIM node, and their Work apps as well as the "Create New App" button will be available, but the streams to which they have access on the consumption site will not be displayed - hence, they won't be able to open production apps in the development node.

The only thing that I have not been able to achieve so far is to not display the Work and Published pseudo folders when the users with Professional license access the CENTRAL node for consumption through the default virtual proxy.  I need to only display the streams and production apps to which these users have access (essentially, make the hub for consumption for users with Professional license behave the same as for users with Analyzer license).  The image below show what I don't want to be displayed to users with Professional licenses.

I don't want to show the Work and Published Folders

Does anyone have any idea about what security rules and attributes control the display of this area in the hub?

@Levi_Turner, @Sonja_Bauernfeind, @Andre_Sostizzo please advise.

Please tag my name, @diagonjope, so that I get a notification of your responses.

Cheers,

++José

[mpc]

Hi, 

Can you check the role of your central node ? 
If it's in developement or both, the personal section will be displayed, if it's in production, no. 

Kind regards

[Levi_Turner · Accepted solution]

The opposite design (Central for Dev, RIM for consumption) will work. Your design will never work. "My Work" appears when one of the following conditions are obtained:

1. The user can create an app

2. The user owns unpublished apps which are accessible via the Engine(s) attached to the virtual proxy

(1) is governed by the Node Type (Dev / both permits app creation, production does not) and security rules.

(2) is governed by the load balancing rules. For your intended design, you cannot un load balance the unpublished apps from the Central's Engine (due to the read-only ResourcesOnCentralNode load balancing rule.

[diagonjope]

Hi @mpc !

Thanks for your response.  The node is set to production. I can still see the "My Work" area (can open the apps, but the "Create New" button is not available).  I am checking Levi's comments to see what changes I need to make.

Cheers,

++José

[diagonjope]

Thank you @Levi_Turner  for your feedback.  As Jacobi used to say "Invert, always invert".  I'll make the changes.

Cheers,

+José

[Levi_Turner]

Great. Reference this load balancing rule: https://community.qlik.com/t5/Qlik-Sense-Documents/Using-Rules-to-segregate-Consumption-from-Develop...

[diagonjope]

I had already read your article (thanks for all your great posts!) and used it to understand a bit better the load balancing rules in QSEoW (this is something where the official documentation needs additional work). In the example you provided, both nodes do reload work, but I don't want the end-user consumption node to do reloads.  The customer is not using SAML either.  So, to determine what to show, I am relying on activating the "extended security" attributes in only one of the VPs and checking if the session IP is empty or not.