Copying Roles between instances

[sri_c003]

Say, I created an NPrinting instance, and created a bunch of roles. And then I want to copy these roles to another instance of NPrinting (same version).

How do i achieve this, not going the backup and restore route since that would apply to all other areas too.

I want a copy of only the various security roles.

This would help me back them up and restore in case I am going for a wipe and clean installation too.

[Lech_Miszkiewicz]

Hi,

Out of the box there is no functionality to COPY roles apart from using an API:

https://help.qlik.com/en-US/nprinting/September2017/APIs/NP+API/index.html#Roles

regards

Lech

[sri_c003]

This API is only for getting the list of roles on server, and for updating them for a specific user. I am looking for some way to copy the roles i.e., export and import. So not of much use for my scenario.

Box 1 --> get all the roles, with all their selections

Box 2 <-- put all the roles retrieved above, with all their selections

[blaise]

If you have a lot of roles (20+)  with a lot of different settings on each role i would try (in a TEST env.) to create 20+ roles (to get a UID for 20+ roles) and then try to update the DB directly (take down NP before).

NB! I havn't tried this and do not really recommend it but if you have a TEST env. you could always try.

With a smaller amount of roles i would just start creating them and maybee build some qlik app using the APi's /DB to verify that the roles in the new system is identical to the old one.

And for the future, lets hope that Qlik builds an import tool for other things than just report. Im more interested in moving an app (with all associated filters, conditions, tasks, etc) from one env. to another but roles could also be of interest.

One other way is of course to ask for a POST endoint for Roles so you could create roles via API.

[sri_c003]

I think the only option would be via an API call or some kind of new feature that allowed export and import of roles.

Copying db wouldn't be feasible, considering it would update every aspect of NPrinting server, and not just roles. I tried to find the specific backup file for roles (there is a bunch of files created) so i could restore only that, but was unable to find since the names are all randomly generated strings.

[blaise]

I'm not suggesting that you should update the whole DB, just alter the role tables.

[sri_c003]

You mean we could alter the role tables directly? Let me check this out.

[blaise]

Should be fairly easy, as long as you've created the dummy roles in web console (to get a role_id) you need to alter the role_action table to tie actions (permissions) to the role and also update role table to correct the name, desc etc.

Further, role_app ties a role to an app if the permissions should be for specific app(s).

Let me know how it goes, interesting project

[Lech_Miszkiewicz]

To be frank i do not see any benefit of migrating roles if you don't create a dependency between roles and other entities like apps users etc..

Since dependencies cannot be re-created as GUID ids will be different what is a point of going into trougble and trying to migrate only part of repository. On the other hand if you want to migrate dependencies like user roles, apps roles etc.. you would need to migrate a lot more and it will be very hard to keep the integrity of repository right.

As you can see on screenshot roles themselfs will not give you much of a gain when imported alone....

[blaise]

I find this thread quite interesting

I don't have access to a NP DB at the moment but i don't think there are any PK GUIDs in role_app or role_recipient, just a role_id and app_id vs role_id and recipient_id.

My recomendation was to create the needed dummy roles in WC to have the interface create the GUIDs instead of trying to create them directly in the db. After that no GUIDs need to be changed / created.

But I totaly agree with you that altering a lot of roles in the DB is only interesting if you connect those roles to apps and users. It will also require some development to link app_id and recipient_id from system 1 to system2.

The fastest way (after investigating this a bit more after my initial "recommendation" with a big NB!) is of course to create the roles and all connections directly in WC - but its a lot more fun to discuss how to do it with code