QS Security by application/user automated

[DireStraits]

Hi, 

Currently we are managing QS security at Stream level. We are loading an Excel file containing User/Stream relationship via User directory connectors. If we create a new Stream we only have to associate the user with the Excel loaded users and the value with the loaded Stream values: 

This works perfectly since it allows us to manage Stream/User security in an easy way. Now I'm trying to add security at application level while mantaining the same level of automation. The idea is to create a new file containing User/Application relationship and load this in an automated way. I want to avoid managing users in the qmc.. 

Anyone knows if this is possible?

Thanks.

[Eduardo_Monteiro · Accepted solution]

Hello @DireStraits 

Yes, it is possible. I did it using Custom Properties and AD groups. 

Create a custom property like "AppLevelSecurity" and add the AD group names as values in the custom property.

Replace default "Stream" security rule with the following condition:

(resource.resourcetype = "App" and resource.stream.HasPrivilege("read") and (resource.@AppLevelSecurity.empty() or resource.@AppLevelSecurity = user.group)) or ((resource.resourcetype = "App.Object" and resource.published ="true" and resource.objectType != "app_appscript" and resource.objectType != "loadmodel") and resource.app.stream.HasPrivilege("read"))

And then create a rule binding it to ad group, see the conditions below:

((user.group=resource.@AppLevelSecurity ))

Please let me know if this is helpful.

BR,

Eduardo Monteiro