topic Re: AD Group for Gallery Admin in Alteryx Server Discussions

AD Group for Gallery Admin

Csand — Wed, 13 May 2020 17:37:07 GMT

Are you able to use AD Groups for Gallery Admin functionality rather than provisioning individual users? I've read the history and it sounds like this is implemented for collections (which i've tested successfully), but possibly not for Gallery-wide permissions.

Re: AD Group for Gallery Admin

naleti — Wed, 13 May 2020 20:07:31 GMT

We integrated OKTA with AD Groups, and when users in these AD Groups log into Gallery for the first time they will be provided default viewer access. Admin will individually assign roles for each user that is logged in via OKTA.

Even though AD Group information is sent in SAML assertion there is no way we could map the Groups to Roles in the Gallery. The Group option is just not available. Not even for Collections with SAML integration.

I am assuming this is only available when using Integrated Windows Authentication.

Re: AD Group for Gallery Admin

Csand — Thu, 14 May 2020 12:49:22 GMT

Thank you, @naleti . I'm shocked that Alteryx can't handle group-based authorization for an enterprise server product.

Re: AD Group for Gallery Admin

OliverW — Tue, 04 Aug 2020 09:51:06 GMT

Hi @Csand ,

did you check the newest Alteryx Server 2020.2 Version?

There now is a possibility to assign Roles to Groups of Users, see here under the "Set a Group Role" paragraph:

https://help.alteryx.com/current/server/administer-users

Let me know, if this helps.

Best wishes

Olli

Re: AD Group for Gallery Admin

Csand — Tue, 04 Aug 2020 12:46:51 GMT

Awesome. we are upgrading next month so will check it out!
--

---------------------------------
Chris J. Sanders
sanders.chrisj@gmail.com

Re: AD Group for Gallery Admin

MPohlers — Thu, 06 Aug 2020 10:03:19 GMT

Hi @OliverW ,

can these groups be synced with AD groups or does this just work when importing the group?
Are all users that are part of the group bulk imported to Alteryx Server?

This answer suggests that this is not possible but it might be outdated:
https://community.alteryx.com/t5/Alteryx-Server/Sync-AD-users-with-AD-group-in-Gallery/idc-p/475145/highlight/true#M1250

Re: AD Group for Gallery Admin

revathi — Sun, 09 Aug 2020 17:31:06 GMT

@OliverW As mentioned in link you had shared, we were able to add an AD group and assign group role as well. Even though the group is added, users within that group do not have the permission granted through Admin -> users page. We experienced same issue in older version of Alteryx Server as well (2019.3). We would add an AD group to a collection -> users tab. Even though the group is added, users within that group never had access to that collection. (Those users had curator access to gallery, yet permission through AD group to a collection didn't provide them access to that collection)

I am certain that this issue/behavior is our env specific. What do you think could be blocking the permission through AD groups in our env ? Any ideas/suggestions ? (Note: all these users are in the same forest)

Re: AD Group for Gallery Admin

adarsh2707 — Thu, 22 Sep 2022 12:38:31 GMT

This was useful. However I am curious, is it possible to set the following features (please refer to the image) for multiple users in one go rather than doing it individually for the users. Can someone please update me on this as we have over 500 users and it may be difficult to set it for each user

Re: AD Group for Gallery Admin

patrick_digan — Thu, 22 Sep 2022 12:58:32 GMT

@adarsh2707 what version of gallery are you on? If it's 21.4+ and have some knowledge of APIs, then you can use the V3 endpoints . I imagine you'd do something like hit the v3/users endpoint to get a list of IDs, then for each ID that you want to update, you'd do a GET request against /v3/users/{id}, make any updates that you need, and then a PUT request against /v3/users/{id} to update the record.

Re: AD Group for Gallery Admin

adarsh2707 — Fri, 23 Sep 2022 06:26:03 GMT

Unfortunately I am unaware of this V3 endpoints API. Will have a look.

While we are at it, Just another question @patrick_digan,

Is there any direct way to update it for an AD group and in turn it gets affected for all users under that AD group.
or would it be possible to add a Distribution list ( AD group email ID, with all users credentials grouped together) and ensure all users in that DL can be configured in one go

We need this to propose to our clients as they may not be comfortable with API

Re: AD Group for Gallery Admin

patrick_digan — Fri, 23 Sep 2022 13:18:04 GMT

@adarsh2707 I don't know of a direct way for you to tie these user items to an AD group.