Security & Governance

[Vegar]

In my last setup of the GSS I notice that the QlikDevelopers does not gain access to create DataConnections in the QMC with the DataConnection Create-rule. The context to the rule is set to "Both in hub and QMC", but as long the QlikDeveloper is not granted read access to the QmcSection_DataConnection she will not be able to access execute her Create, Read, Update or Delete rights in QMC.

Am I right?

3. Name: _gss – DataConnection Create

• Description: Allow users to create data connections except of type folder.
• Actions: Create, Read, Update, Delete
• Resource filter: DataConnection_*
• Conditions:

  user.group="QlikDeveloper" or user.group="QlikTeamAdmin" or user.group="QlikRootAdmin"

• Context: Both in hub and QMC
• Tags: Custom Rule

A solution is to add QmcSection_DataConnection into the resource filter. Another solution is to limit the context to "Only in hub" to avoid missintepretation of the rule. What will the consequence be for QlikTeamAdmin and QlikRootAdmin be if we limit the rule to only Hub?

What do you think about this? Should a Developer be granted access into the QMC to alter dataconnections?

[#2 · Accepted solution]

Hi Vegar, apologies for the significantly late reply.  I think it depends on what your wanting to provide as capabilities to the developer.  A couple of things:
1. It's not possible to create data connections via the qmc.  They can only be created in the hub.
2. The rule context is probably not correct as you point out.  It should probably be only in the hub.
3. Personally, I think depending on the developer they may need to be able to make changes to the data connections they own from the qmc.  That said, they can easily change them from the hub as well.  The danger of changing them is that other apps that rely on the data connection may fail to refresh if the change made impacts the data available through the connection.

[Vegar]

The core of this issue was the enabeling of edit right and not the create as I stated in my question. This becomes an issue when the developer make changes to a non-personalized DataConnections/LIB. 

Eg.

When a developer makes changes to a DataConnection (LIB) named  "ProjectFolder" it will be automatically renamed into "ProjectFolder (DOMAIN\User)" and break all other applications references to the "ProjectFolder" lib.

To prevent breaking references to other applications I allow developers to edit the DataConnection in QMC. As far as I know there is not possible to bypass the (DOMAIN\User) naming standard from the HUB.