Security rule for creating ReloadTask with a schedule trigger

[vegard_bakke]

Hi!

We have several departments that shall not see each other streams or apps. 

Each department has a PowerUser that is allowed to run and create reload tasks for apps in their own stream.

We've got most working. The PowerUser can create the task, and for their own apps only.  BUT, when creating the Trigger, I get the error message: 'The operation failed due to insufficient privileges'.

(Failing on: POST https://qlik.company.com/dev/qrs/ReloadTask/update)

The same POST works a litte earlier, but with a different content. 'schemaEvents' is empty, and 'task' has content.

The setup

The developers get publish access to their stream, with a SAML attribute (similar to an  AD-group).

One PowerUser get a Qlik Role 'PowerUser'.

What have we done?

In addition to the QMC rule: Resouree: 'QMCSection_App, QMCSection_Task', Condition: ((user.roles="PowerUser"))
We created the security rule:

Resource: ReloadTask_*,SchemaEvent*
Action: Create, Read, Update, Delete
Condition:

   ((user.roles="PowerUser"
   and resource.app.stream.HasPrivilege("publish")
   ))

Context: QMC Only

I think maybe it is the  'resource.app.stream.HasPrivilege("publish")' that breaks the rule, when we are saving the task trigger (the SchemaEvent ? ). Is seems to be working when saving the reload task itself.

But what is inside the 'resource' object, when 'resource.resourcetype' is "SchemaEvent"?

The GitHub - levi-turner/Qonnections2018-Rules is great for existing examples.  But I cannot find any resources telling me the hierarchy within the 'resource'.

A very similar rule works very well for letting the PowerUser delete, import, export app, that the normal developers can only publish:    Condition: ((user.roles="PowerUser"  and resource.stream.HasPrivilege("publish")))

Any nice xmas helpers out there...? 🙂

[rubenmarin · Accepted solution]

Hi @vegard_bakke, first note that this is the Qlikview forum, not the Qlik sense forum, probably you can get more help there.

I'm not sure if you also need to give permissions to QmcSection_CompositeEvent or CompositeEvent resources, I don't have now a qmc available to make test.

In case it can help, here is the help page with the available resources: https://help.qlik.com/en-US/sense/June2019/Subsystems/ManagementConsole/Content/Sense_QMC/available-....

I would try a rule with a named user to make tests until it works for that user, just to identify the needed permissions.

[vegard_bakke]

Arg. Sorry, I didn't see that the Security & Governance had the word 'QlikView' in front of it.


I have created a new post in  'Qlik Sense Deployment & Management'.  Please, if someone would like to reply to this thread, post them in: https://community.qlik.com/t5/Qlik-Sense-Deployment-Management/Security-rule-for-creating-ReloadTask...

(PS QmcSection_CompositeEvent  didn't seem do the trick. At least as the only change.)

EDIT: I see from Event triggers that Qlik call "event triggers" for CompositeEvents, and "scheduled triggers" for SchemaEvents. In that case, QmcSection_CompositeEvent will be required for me as well. 🙂