Deny access to edit load script on work stream (Prod Node)

[jpjust]

Hi - We have the clustered environment (Dev and Prod node)

When developers to go their work stream in DEV Hub they can load script editor and run the script.

But when developers to go their work stream in Prod Hub, they are able to  load script editor and run the script. I wanted to disable this. Is  this possible?

Thanks

[Mike_Dickson]

Hello @jpjust 

You could look into the option of making the node "Production" within the QMC. 

https://help.qlik.com/en-US/sense-admin/November2021/Subsystems/DeployAdministerQSE/Content/Sense_De...

The effects of choosing the different options are as follows:

• Production: this server is intended to support users to access apps but not create them. This means that when a user connects to this node, the Create new app button in the hub is not displayed to the user. To hide the Work section in the hub, you need to disable the security rule that grants the application owner access. This means that when a user connects to this node, the buttons in the hub to create apps and the Work section are not displayed to the user. You cannot edit an app on a production node.

[jpjust]

Thanks Mike.

My node is already marked as Production.

I am specifically looking for this - .o hide the Work section in the production hub, you need to disable the security rule that grants the application owner access.

Do you know which security rule it is talking about?

Thanks

[Mike_Dickson]

@jpjust 

If the user does not own any applications, then the "Work" stream will not show up at all for the user when the node is in "Production" mode.

But if the user does own an application, the "Work" stream will be displayed and will be able to access the "Data Load Editor" unless you disable the default rules called "Owner" and "OwnerUpdateApp" as these grant the action of "Update" to the owner of the application.

Please review the security rules and make sure before disabling them, that it does not prevent any other features your users might need.

The screen shot I have below is an application in my "Work" stream that I own, but you can see that I do not have access to the Data Load Editor. Also when going into the sheets, I do not have access to "Edit Sheet"

[jpjust]

Thanks Mike.

I just tested it. Disabling both the security rules work when I go Prod hub and try my app's. (Data load editor and sheet edit are disabled)

The issue is, even in my dev hub this limits editing the script and sheet.

I want to allow edit on dev hub work stream.

[jpjust]

Hi Mike - Any thoughts / suggestions on this?

Thanks