Qlik Sense for Windows: How to allow task reloads on the Hub

[John_Sathya]

Security Rules can be configured to allow end-users to reload tasks directly from the Qlik Sense Hub. This way the users who don't have access to Qlik Sense Management Console can run the tasks that are created for the app directly from the hub.

Environment

• Qlik Sense February 2021 & later (For "Manage reload tasks": start/stop existing tasks from the hub)
• Qlik Sense May 2021 & later (An addition to "Reload": create tasks from the hub)

Security Rule examples are provided as-is. Further customization cannot be supplied by Qlik Support and we recommend engaging with our active community in the Qlik Sense Management forums for further assistance. 

Requirements and Considerations

• By default, a user will have Read and Update permissions on Apps they own, whether they are Published or not. 
• If you intend to give users permission to reload a published App they do not own, a separate security rule will be necessary to enable Read and Update permissions on the App. 
• A Professional License. Analyzer licenses will only be able to view tasks, even with the security rules in place. 
• By default, all users have access to the required HubSection_Task. This is the starting point to allow users to reload from the hub. If custom rules have been implemented that block access to HubSection_Task, this needs to be lifted or customised.

Note: Too many tasks run in parallel by users can cause a performance impact. 

Set up the Security Rules:

1. Open the Qlik Sense Management Console
2. Go to Security Rules in the left side menu
3. Click Create New 
4. Set up either a for only managing existing tasks only or b for creating new tasks and managing existing tasks:
   
   
   1. Start and Stop existing Reload Tasks only
      
      Name: Reload Access from Hub (example) 
      Description: Allows users to reload apps from the hub  (example) 
      Resource filter: ReloadTask_* (Can be chosen from the dropdown menu next to the box)
      Actions: Read, Update 
      Conditions: Specify your user or group or role.
      
      
   2. Create a new Reload Task and launch it as well as manage existing tasks
      
      Name: Reload Access from Hub (example) 
      Description: Allows users to create reloads from the hub  (example) 
      Resource filter: ReloadTask_* (Can be chosen from the dropdown menu next to the box)
      Actions: Read, Update, Create 
      Conditions: Specify your user or group or role.
      
      
5. Apply both rules

The specified users can now right-click on the hub to access the Management Reload Task (rule a) or/and Reload option (rule b). See Fig 1.

Fig 1

Clicking Reload to initiate the reload and open the App in a new tab.

Clicking Manage reload tasks to access all available reload tasks for this App. Tasks can then be started (Fig 2) or stopped (Fig 3)from this menu.

Fig 2

Fig 3

Additional Notes:

• Giving access to the Apps will always expose the Manage Properties option.
  
  This can be mitigated by modifying the existing ReadCustomProperties rule to fit your needs. However, this will not hide the Manage Properties option. 
  
  
• Giving Update permissions to users allows them to edit the App's name, description, and thumbnail. This is working as expected. 

[Or]

@mbespartochnyy  Likewise, good summary. Unfortunately I can't use any of it because Qlik insists that we give update permissions on the app, which means users would be able to change the app description and name (completely unacceptable for a published app they don't own)... but you've a great job of navigating through the requirements and explaining them.

[mbespartochnyy]

Thanks! With current setup it's not a rule that makes it acceptable to release to users in my environment either.

I still use the functionality, though, for my own convenience. I put together a custom rule that allows me and my trusted colleagues who know not to change anything on a published app to launch reload of apps from the Hub. That saves a trip to QMC, but that's the extend of it.

As of right now, in my environments, this is not a functionality that enables reloads of apps from the Hub, it's a functionality that saves me and other devs a trip to QMC.

[NickSPH]

Actually, it seems the visibilty of 'Manage reload tasks' may be at fault here. I've just tried using a security rule with the conditon

((resource.name="JustAboutAnything" or resource.app.name="Dashboard"))

which does seem to (mostly) work! I can view the reload task in the hub for the app named Dashboard, and cannot view any reload task for other apps.

The first part makes the 'Manage reload tasks' available for any app with update-access. It doesn't matter what name you enter here, I certainly don't have any reload task named 'JustAboutAnything'. The second conditon is what we are interested in, and only makes reload tasks visible where that condition evaluates to true.

@mbespartochnyy Can you check if adding an OR-condition using resource.name works correctly? It should enable the 'Manage reload tasks' button for all apps with update-access, but only show the reload tasks assigned to your TestApp. The complete condition can for example be

((resource.name="JustAboutAnything" or resource.app.name="TestApp"))

In conclusion, it actually seems the visibility of the 'Manage reload tasks' is faulty. In my opinion it should be visible if the user has update-access to the app itself and read-access to any reload tasks assigned to the selected app. However, for the reload tasks it seems it now checks if any security rule is assigned for a resource-property, and does not check for any resource.app-property.

Hopefully, this can be fixed in a future Qlik Sense release?

[mbespartochnyy]

Huh! How about that! It works! Good find @NickSPH!

It makes zero sense but, yes, adding an OR condition to the rule with resource.name="JustAboutAnything" or really any other dummy value makes the Manager Reload Tasks menu appear.

[NickSPH]

Great! Thank you for your confirmation @mbespartochnyy!

As we have determined the logic behind the visibility of the 'Manage reload task'-button can be improved. If Qlik decides to change the logic, perhaps they can also provide an option to allow users to execute the reload task without having update permissions on the app itself as suggested by @Or . It is a bit strange, as the update itself is performed by INTERNAL/sa_scheduler. Maybe an execute permission for the ReloadTask can be added to specify which users may execute an existing reload task?

This would also allow administrators to let their users just view reload tasks to see when the app is scheduled to refresh its data (with read permission on the reload task) and optionally allow them to manually refresh (with the suggested execute permission)

Unfortunately, it seems this would need more modifications. With only read permissions on ReloadTask_* and QMCSection_Task I'm unable to start a reload task in the QMC. Right now, the user really needs update permissions on App_* to run the reload task. It isn't just about visibility.

A workaround may be to allow specific users read permissions to QMCSection_Task, read permission to specific ReloadTask_*, and update permissions to specific App_* all within QMC. The user will be unable to edit reload tasks and apps in QMC, but are able to start reload tasks with these permissions. It's not very user-friendly, but it bypasses the possibility of users renaming published apps while allowing users to manually start a reload task.

Just one final note, I wasn't able to view reload tasks in the Hub for a user with an Analyzer license even with the resource-filter * and all permissions. The original post mentions that Analyzer users should be able to view reload tasks. The workaround using the QMC does work for any user even without a Qlik Sense license, but I don't know if this would violate any Qlik license agreement.

[giociva]

Hi,

as stated in this article

https://help.qlik.com/en-US/sense/August2022/Subsystems/Hub/Content/Sense_Hub/Apps/app-reload.htm

starting from Aug 2022 should be possible to create/update/delete tasks from hub.

I'm running Aug 2022 patch 1 but the exposed features are the same as May 2022 and reported here:

https://help.qlik.com/en-US/sense/May2022/Subsystems/Hub/Content/Sense_Hub/Apps/app-reload.htm

I also created this sec rule on my user.id to prevent any permission issue:

resource filter = *

Actions = all 

context = only in hub

Am I missing something?

thanks.

[giociva]

IMO this feature fits perfectly in a self-bi scenario, allowing users to manage their own app's taks only without having to move to QMC (as stated here "The QMC is not designed to be a self-service tool, it is intended for a limited number of administrators. Keeping the number of admins down benefits performance").

Best,

[snibrahim1993]

@John_Sathya  Hi, I have tried the same way but it's not working for the analyzer users.
Is it possible to do the same for the analyzer users?
I cannot see the start/stop icon in the action

Please refer to the attached

Thanks

[Sonja_Bauernfeind]

Hello @snibrahim1993 

A Professional License is required. See the Requirements and Considerations in the article.

All the best,
Sonja