Splitting permissions over two Security Rules?

[simonheap_cph]

Hi there!

How does NPrinting work, if a user is assigned to more than one Security Rule? Do the permissions "add up"?

I'm trying to work out a setup where I can split what NPrinting users can do and what data they have access to. I have some "Data"-roles where each role has access to different apps in the Selected items-section. Also, I have some "Role"-roles that define what the user can do, i.e., roles for a developer, a tester an end user and so forth.

The general idea is, that I have different developers that should be able to do the same stuff: work with reports and tasks. But each developer might work with different data. So, a user always has two roles: one for what data they can see (apps) and one that decides what they can do (create new, edit, delete, view etc.).

I have an admin-role too that sets up the apps and connections as a prerequisite for the above.

Only it doesn't work as I would expect! On the "Role"-roles there is no access to apps, this access is on the "Data"-role. But it is the role with the app permission, that decides what can be done - without an app in Selected items, nothing can be done, no new app can be created and so on.

But if I add the developer's permissions on the "Data"-role where the app resides, then the end user can do the  same as the developer. And that was not the intention...

Hoping someone has tried something similar!

Best regards

Simon

[Ruggero_Piccoli]

Hi,

About Roles you can refer to https://help.qlik.com/en-US/nprinting/May2023/Content/NPrinting/DeployingQVNprinting/Managing-roles....

You must always have at least one user with the build-it Administrator role. 

You can control access permission at Qlik NPrinting App level and you must select at least one app (or many or all) for each role. So, if you want to create a Developer Role for App1 you will select only that app. Based on your description I think you missed this point, the apps selection. Then you apply this role to the users you want to give those privileges to that App1.

If you want the same users can work as viewers on App2 and App3 you will create another rule, with those 2 apps selected aon only view privileges. Than you will assign the two roles to the users. 

Best Regards,

Ruggero

[simonheap_cph · Accepted solution]

This is what I was hoping to avoid. You are missing my point about EndUsers who only use NewsStand and On-Demand buttons in Qlik Sense. I was hoping to have the two roles Developer and EndUsers with different actions allocated, but sharing the same "Data"-security role for the app. I understand from your reply that this is not possible - ?

[David_Friend · Accepted solution]

that is correct.

[simonheap_cph]

That calls for a suggestion to a future update 😉

[Ruggero_Piccoli]

Hi,

You can create a security role with only On-Demand rights for one app like the following: 

The other checked rights are needed to enable On-Demand and are automatically activated. 

Best Regards,

Ruggero

[Lech_Miszkiewicz]

Hi @simonheap_cph 

You can always suggest such idea on: https://community.qlik.com/t5/About-Ideation/ct-p/qlik-aboutideation. Thats exactly what Ideation page is for.

cheers