Unlock a world of possibilities! Login now and discover the exclusive benefits awaiting you.
May 31, 2023 3:11:36 AM
May 15, 2021 11:05:00 AM
Security Rules can be configured to allow end-users to reload tasks directly from the Qlik Sense Hub. This way the users who don't have access to Qlik Sense Management Console can run the tasks that are created for the app directly from the hub.
Security Rule examples are provided as-is. Further customization cannot be supplied by Qlik Support and we recommend engaging with our active community in the Qlik Sense Management forums for further assistance.
Note: Too many tasks run in parallel by users can cause a performance impact.
The specified users can now right-click on the hub to access the Management Reload Task (rule a) or/and Reload option (rule b). See Fig 1.
Clicking Reload to initiate the reload and open the App in a new tab.
Clicking Manage reload tasks to access all available reload tasks for this App. Tasks can then be started (Fig 2) or stopped (Fig 3)from this menu.
@mbespartochnyy Likewise, good summary. Unfortunately I can't use any of it because Qlik insists that we give update permissions on the app, which means users would be able to change the app description and name (completely unacceptable for a published app they don't own)... but you've a great job of navigating through the requirements and explaining them.
Thanks! With current setup it's not a rule that makes it acceptable to release to users in my environment either.
I still use the functionality, though, for my own convenience. I put together a custom rule that allows me and my trusted colleagues who know not to change anything on a published app to launch reload of apps from the Hub. That saves a trip to QMC, but that's the extend of it.
As of right now, in my environments, this is not a functionality that enables reloads of apps from the Hub, it's a functionality that saves me and other devs a trip to QMC.
Actually, it seems the visibilty of 'Manage reload tasks' may be at fault here. I've just tried using a security rule with the conditon
((resource.name="JustAboutAnything" or resource.app.name="Dashboard"))
which does seem to (mostly) work! I can view the reload task in the hub for the app named Dashboard, and cannot view any reload task for other apps.
The first part makes the 'Manage reload tasks' available for any app with update-access. It doesn't matter what name you enter here, I certainly don't have any reload task named 'JustAboutAnything'. The second conditon is what we are interested in, and only makes reload tasks visible where that condition evaluates to true.
@mbespartochnyy Can you check if adding an OR-condition using resource.name works correctly? It should enable the 'Manage reload tasks' button for all apps with update-access, but only show the reload tasks assigned to your TestApp. The complete condition can for example be
((resource.name="JustAboutAnything" or resource.app.name="TestApp"))
In conclusion, it actually seems the visibility of the 'Manage reload tasks' is faulty. In my opinion it should be visible if the user has update-access to the app itself and read-access to any reload tasks assigned to the selected app. However, for the reload tasks it seems it now checks if any security rule is assigned for a resource-property, and does not check for any resource.app-property.
Hopefully, this can be fixed in a future Qlik Sense release?
Huh! How about that! It works! Good find @NickSPH!
It makes zero sense but, yes, adding an OR
condition to the rule with resource.name="JustAboutAnything"
or really any other dummy value makes the Manager Reload Tasks menu appear.
Great! Thank you for your confirmation @mbespartochnyy!
As we have determined the logic behind the visibility of the 'Manage reload task'-button can be improved. If Qlik decides to change the logic, perhaps they can also provide an option to allow users to execute the reload task without having update permissions on the app itself as suggested by @Or . It is a bit strange, as the update itself is performed by INTERNAL/sa_scheduler. Maybe an execute permission for the ReloadTask can be added to specify which users may execute an existing reload task?
This would also allow administrators to let their users just view reload tasks to see when the app is scheduled to refresh its data (with read permission on the reload task) and optionally allow them to manually refresh (with the suggested execute permission)
Unfortunately, it seems this would need more modifications. With only read permissions on ReloadTask_* and QMCSection_Task I'm unable to start a reload task in the QMC. Right now, the user really needs update permissions on App_* to run the reload task. It isn't just about visibility.
A workaround may be to allow specific users read permissions to QMCSection_Task, read permission to specific ReloadTask_*, and update permissions to specific App_* all within QMC. The user will be unable to edit reload tasks and apps in QMC, but are able to start reload tasks with these permissions. It's not very user-friendly, but it bypasses the possibility of users renaming published apps while allowing users to manually start a reload task.
Just one final note, I wasn't able to view reload tasks in the Hub for a user with an Analyzer license even with the resource-filter * and all permissions. The original post mentions that Analyzer users should be able to view reload tasks. The workaround using the QMC does work for any user even without a Qlik Sense license, but I don't know if this would violate any Qlik license agreement.
Hi,
as stated in this article
https://help.qlik.com/en-US/sense/August2022/Subsystems/Hub/Content/Sense_Hub/Apps/app-reload.htm
starting from Aug 2022 should be possible to create/update/delete tasks from hub.
I'm running Aug 2022 patch 1 but the exposed features are the same as May 2022 and reported here:
https://help.qlik.com/en-US/sense/May2022/Subsystems/Hub/Content/Sense_Hub/Apps/app-reload.htm
I also created this sec rule on my user.id to prevent any permission issue:
resource filter = *
Actions = all
context = only in hub
Am I missing something?
thanks.
IMO this feature fits perfectly in a self-bi scenario, allowing users to manage their own app's taks only without having to move to QMC (as stated here "The QMC is not designed to be a self-service tool, it is intended for a limited number of administrators. Keeping the number of admins down benefits performance").
Best,
@John_Sathya Hi, I have tried the same way but it's not working for the analyzer users.
Is it possible to do the same for the analyzer users?
I cannot see the start/stop icon in the action
Please refer to the attached
Thanks
Hello @snibrahim1993
A Professional License is required. See the Requirements and Considerations in the article.
All the best,
Sonja