Security Rules: Control Access to sections in QlikSense Management Console

[Maria_Halley]

A user has been given permissions to a section of the Management Console with a new security rule (example: Apps or Streams), but when they access the console, all sections remain grayed out.
 

To give a user access to the different sections in the QlikSense Management Console, seperate rules need to be added to allow access to QMC Section Resources. 

The following filters are used to grant access to the different sections. A user with access to a QMC section can open that section, but will only see objects according to the user's access rights.

QMC section resources

Resource filter Filter will target

QmcSection_App	The QmcSectionApp resource
QmcSection_App.Object	The QmcSectionApp.Object resource
QmcSection_App.Sheet	The QmcSection_App.Sheet resource
QmcSection_App.Story	The QmcSection_App.Story resource
QmcSection_Audit	The QmcSectionAudit resource
QmcSection_Certificates	The QmcSectionCertificate resource
QmcSection_Certificates.Export	The QmcSectionCertificateExport resource
QmcSection_CompositeEvent	The QmcSectionCompositeEvent resource
QmcSection_ContentLibrary	The QmcSectionContentLibrary resource
QmcSection_CustomPropertyDefinition	The QmcSectionCustomPropertyDefinition resource
QmcSection_DataConnection	The QmcSectionDataConnection resource
QmcSection_EngineService	The QmcSectionEngineService resource
QmcSection_Event	The QmcSectionEvent resource
QmcSection_Extension	The QmcSectionExtension resource
QmcSection_License	The QmcSectionLicense resource
QmcSection_ProxyService	The QmcSectionProxyService resource
QmcSection_ReloadTask	The QmcSectionReloadTask resource
QmcSection_RepositoryService	The QmcSectionRepositoryService resource
QmcSection_SchedulerService	The QmcSectionSchedulerService resource
QmcSection_SchemaEvent	The QmcSectionSchemaEvent resource
QmcSection_ServerNodeConfiguration	The QmcSectionServerNodeConfiguration resource
QmcSection_ServiceCluster	The QmcSection_ServiceCluster resource
QmcSection_Stream	The QmcSectionStream resource
QmcSection_SyncRule	The QmcSectionSyncRule resource
QmcSection_SystemRule	The QmcSectionSystemRule resource
QmcSection_Tag	The QmcSectionTag resource
QmcSection_Task	The QmcSectionTask resource
QmcSection_Token	The QmcSectionToken resource
QmcSection_User	The QmcSectionUser resource
QmcSection_UserDirectory	The QmcSectionUserDirectory resource
QmcSection_UserSyncTask	The QmcSectionUserSyncTask resource
QmcSection_VirtualProxyConfig	The QmcSectionVirtualProxyConfig resource
QmcSection_PrintingService	The QmcSectionPrintingService resource

Related Content

• Security Rule Example: License Management only access in the Qlik Sense Management Console (QMC) 
• Qlik Sense Management Console sections grayed out and cannot be accessed 
• Available resource filters 

[john_oll]

QUESTION:

If I give a user (that has no admin roles!) the "QmcSection_App" with "Read" right for "QMC only", then the user can view the App list in the QMC. This works.

BUT the Apps list in QMC, when tested, shows ALL apps, including those that should be invisible (=no rights) according to AUDIT for that user in QMC.

Feels like a bug, or is this known and intended?? Wondering if I should open a ticket.

Trying to view the actual list entry (via edit/doubleclick) gives an error.
But I think the user should not even see that those apps exist, since this it is part of "read" in my opinion.

[john_oll]

EDIT:
Might have been just a weird caching issue, since the list now only shows the intended Apps,
AND the same user used to be an admin an hour before.

[Sonja_Bauernfeind]

Hello @john_oll !

Thanks for updating us here. Cache sounds like a likely suspect here. Have you restarted the repository service to clear it or did you see the improvements happen after time?

[john_oll]

Hi Sonja,
happened without restarting any services,
happened after applying the "show only own apps" bookmark and switching back to  all (visible) apps that it fixed itself.
If we see it again for another user, I will post an update.

[john_oll]

General feedback:
For some of those mentioned it is not obvious what they refer to and if they have any effect.
That is:
What is
QmcSection_CompositeEvent The QmcSectionCompositeEvent resource ?
and what is
QmcSection_SchemaEvent  The QmcSectionSchemaEvent resource   ?

My best guess would be "might be related to task triggers? but not needed, if true, as far as I can tell" .

[Sonja_Bauernfeind]

Hey @john_oll 

Thanks again for the feedback! As for your questions there, let me go take those and ask SMEs/search our documentation some. See if I can figure it out 🙂

-Sonja

[Sonja_Bauernfeind]

@john_oll Aha, found it: Available resource filters 

CompositeEvent

Task triggers in the scheduler

SchemaEvent

Details for when a scheduled task will run

[BuTbka]

What is the resource filter for On-demand apps service in QMC?

[Sonja_Bauernfeind]

You can find a list of available filters here: QMC section resources.

Odag is the one you are looking for, I believe (QmcSection_OdagService).

[Giovanni_Civardi]

@Sonja_Bauernfeind I cannot find qmc section for log collector in documentation, can you please provide details?
Thank you.