Thank you for cross-tagging this @MarqueeCrew !
Hey @elsastark
First thing to confirm - you're not missing something easy and obvious - this is a challenging request in Alteryx currently.
What other applications do is called "kerberos passthrough" or "implicit kerberos" - where the gallery would know that user SeanAdams is logged in; and would pass this information on to the underlying DB which would authenticate as SeanAdams. This has some pros and cons though - namely:
- cons: If you are doing enterprise level reporting, you want everyone to get the same summary details (e.g. the company sold X widgets, irrespective of who the person is that's asking the question)
- pros: as you say - there are cases where you only want people to be able to see the details that they are entitled to.
Given that Alteryx does not provide for Kerberos passthrough - you have a few options:
- You can use the Run As functionality - I've not used this myself, but I believe it's possible to configure the server to allow users to specify their credentials at the time of running the canvas. If you do this - then you'll need to make sure that all your database connections are set up as "Trusted" connections - i.e. don't specify a username and pwd, just use the requester's credentials. On MS SQL server, this is just the text "trusted=yes" in the ODCB connection string (or something similar). Alteryx Analytics 10.5 Introduces New Workflow Exe... - Alteryx Community
- Create something like kerberos passthrough.
- Make this an analytical app where you ask for the user's name & pwd - and them pass them through into the DB connection. This may not be allowed by your compliance folk because of the possibility of you storing a copy of the user's username & pwd somewhere.
- You can filter the data by the user name.
- Similar to the post below (Solved: Gallery authentication pass thru to workflow - Alteryx Community) - you can probably use an internal variable like "__cloud:UserID" to find out the internal Alteryx User ID. You'd then need to query the server's Mongo DB to figure out the user name. This can get very complex very quickly.
- Once you have their username; you can then filter the results using logic in your Alteryx canvas, or in your DB (for example, you can pass the username in the select query like "select * from sales where salesPerson = 'SeanAdams'"
- or you can do this on the Alteryx side if you have the row-level security logic handy and can implement this in Alteryx
- or you can ask them just for their user-name on the gallery as a single box, and do the same as above (filter inDB or filter in Alteryx)
- Run on desktop:
- If they have alteryx installed on their desktop - you can package this as an application and they just need to double-click on it (desktop IS able to pass identity through to the DB, so if your row-level security is set up on DB level, then this will work seamlessly)
So - sadly there's no easy option - I think that "Run this canvas always with Kerberos Passthrough" would be a very good server idea - and it's worth you logging this under Server Ideas (https://community.alteryx.com/t5/Alteryx-Server-Ideas/idb-p/server-ideas) and tagging Mark and I on that, and we'll support your suggestion and add to that discussion.
Good luck @elsastark - once you have a solution that works, let us know how it goes on this thread so that other folk can learn from your journey?
Have a good week
Sean
Here's another post that deals with the same topic:
Solved: Gallery authentication pass thru to workflow - Alteryx Community
