Managing In-DB Connections Enterprise Wide

Question

Hello Community!

I have been combing the Community looking for ways to manage in-DB connections for a larger enterprise (roughly 200 Designer users).

The best idea I have heard is having a SharePoint site with folders for the different collections and/or credentials. Inside those folders, there would be the .indb files that someone could reference inside of their workflow so that there is one source of truth. This would also allow when a department adds a new person, they are granted access to that folder and have all of their data connections ready.

Any other ways of doing this or tips of things I should consider?

raychase · Answer

I make the Alteryx Server's SystemConnections.xml available as a UserConnections.xml for all of our Designer users.  That way, they are guaranteed to have the exact same connections that exist on the Alteryx Server.

hroderick-thr · Answer

We have standard ODBC names defined on the server and require those to be used.

We set up In-DB names identical to the ODBC names so users don't have to remember different names.

elsastark · Answer

Hi @MatthewO - thank you for the idea. We aren't able to move to DCM (yet) since, from my understanding, we can't control access of DCM through custom groups. We have a policy around the data source owner needing to approve access before someone can use the data source, not the person developing the workflow.

A lot of this comes from our data privacy controls. For example, User A is developing a workflow and has access to write to Database XYZ. They create a database connection and want to share it with User B. We need to ensure User A isn't sharing any credentials with User B unless the data source owner of database XYZ has approved. Also, our data source owners for the most part do not use or have access to Alteryx Gallery.

That is why we have mostly used Gallery data connections - we can set up Windows Active Directory groups with the data source owner as the approver, load them into a Gallery custom group, then set them up for access to a database connection. Then, when someone wants to use a data connection, they simply need to be added to that Active Directory group and the data source owner receives an approval request. We can also flag when a workflow isn't using Gallery data connections and make sure that they move to this model to avoid any risk of data being seen or modified by someone who hasn't been approved to access that data.

If you see a way we could leverage DCM while also making sure someone isn't accidentally (or purposefully) given access to a database without the data source owner's approval then I would love to leverage it for In-DB! I am very new to DCM so there may be something I'm missing - thanks for the help!