Alteryx Server/Gallery Security Settings with Windows Authentication

[okyang]

Hi Everyone,

I had the opportunity to install an Alteryx Server for a client who have few concerns on Alteryx's security settings. I have noted down their questions and was wondering have anyone encounter them before?

Thanks a lot!

Yang

Alteryx Version 11.8

Installation type: Single Node Deployment server with Alteryx Gallery, Controller, Designer.

Authentication: Windows Authentication

1. The client saw that users are automatically added to the Alteryx Gallery User page whenever they click on the gallery URL from their own desktop.

(Even though they have not been added to the Alteryx server Gallery Users’s panel).

For example, if a user click on the link  http://abc/gallery from their desktop, his/her User ID will be created in Gallery.

Is there anyway to disable this?

2. Alteryx Gallery pages are served through the default URL e.g http://abc/gallery, can the URL be changed to http://abc/alteryx/gallery?

If so, what are the steps/configuration needed – would a modify of DSN help?

(https://community.alteryx.com/t5/Alteryx-Knowledge-Base/Changing-the-Gallery-URL-on-Alteryx-Server/t...).

3. The client would like to know should IIS be installed on their single node  Alteryx server 11.8 even though they do not require SSL now?

We have access the Gallery (with no IIS installed on the server) successfully from a desktop client.

It seems like Alteryx has a prepackaged web server/service that is serving Alteryx gallery pages?

4. For a Dual Node deployment One Controller and One Gallery Box, where should the IIS be installed, if we need to use SSL?

5. The user would like to know how to deactivate gallery users?

Unlike the gallery with Built In Authentication,

he cant find any option to deactivate the users through the admin gallery  for a Server that has Windows Authentication?

Seems like the community has indicated that currently this can’t be done.

https://community.alteryx.com/t5/Setup-Configuration/how-to-delete-user-from-Alteryx-Gallery/m-p/521...

[patrick_digan]

@okyang Here are my thoughts on 1 and 5.

1. The client saw that users are automatically added to the Alteryx Gallery User page whenever they click on the gallery URL from their own desktop.
(Even though they have not been added to the Alteryx server Gallery Users’s panel).

For example, if a user click on the link  http://abc/gallery from their desktop, his/her User ID will be created in Gallery.

Is there anyway to disable this?

The admin can go to permissions and change the default to no access. This will prevent people from any and all access to the gallery. Then everyone who you want to have access would have to be added one by one. You could add them all through this admin page, or you could create an Active Directory group ("Alteryx users" for example) and then have people added to that group whenever they need access.

2-4 Not sure.

5. The user would like to know how to deactivate gallery users?

Unlike the gallery with Built In Authentication,

he cant find any option to deactivate the users through the admin gallery  for a Server that has Windows Authentication?

Seems like the community has indicated that currently this can’t be done.

https://community.alteryx.com/t5/Setup-Configuration/how-to-delete-user-from-Alteryx-Gallery/m-p/

Similar to #1, you could block access for these people by manually handling it through Alteryx permissions or Active Directory Groups. So you could set the default to block access, add your users to an Active Directory group "Alteryx Users" and give this group requisite permissions in the Alteryx Permissions page. Then when you wanted to deactivate somebody, you could just remove them from the Alteryx Users AD group and they would go back to having no access.

[KaneG · Accepted solution]

In answer to 2-4

2. This can be configured in System Settings, however the DSN would be easier

3. IIS is not needed. Gallery is self hosted on WCF, rather than needing a separate web server.

4. If you are using IIS to host the SSL cert, then it should be on the Gallery Server.

Kane

[okyang]

Thanks for the great answers Kane and Patrick.