API endpoints for managing users/groups

[veruzi]

Hey Team,

With 2020.3, the new Groups feature came into light, which is great, but seems like it was only half-thought.

It would have been nicely complemented with some API endpoints that would allow managing the groups' members - add, remove, list members, etc.

Seems like the API on Alteryx is like 100 steps behind and seems like the new developments are not considering adding APIs for the new released features. I feel this is a product roadmap issue.

As an admin, I would like far more ways to automate managing the Server/Gallery than the ones currently provided by Alteryx.

Integration with AD would be nice as well, we use SAML, and would like to have the option to import AD groups that would sync automatically in Alteryx - same way Tableau has those groups that are imported directly from AD.

Thanks,

Alex

[KylieF]

Thank you for your feedback!

We appreciate the feedback on what APIs would be most useful to users and how they'd be used.  If you haven't yet, be sure to review our Submission Guidelines, which go over the boards in a bit greater detail.

[aplima]

Completely agree with @veruzi, the new group feature is indeed half way to say the least.

We also use SAML and miss the ability to use groups for access to collections/credential/data connections and etc...

Having support to SAML groups would be best. A complete AD group import/sync doesn't work well for us, we have far too many AD groups as we have +100K AD users over the World in a multi-domain forest. I've seem full user/group syncs taking days to complete.

So something that would work well is some sort of "AD group lookup then sync" feature, like you allow searching AD for the groups, then sync only the groups which are actually used on ACLs, this way a sync could actually work very well.

This is how I'd do that in a very high level 😉:

1. UI allow users to type a partial group name and hit a search button
2. UI calls an API endpoint that look if group is already synced (available in a local DB), if not it searches AD for group details
3. UI present group details (e.g. full name, description, domain name, no need to show members)
4. If user creates an ACL assignment, that group ID/name is pushed to a queue for group backend Sync up
5. Backend service monitors the queue for immediate sync needs (to catch up with with ACL assignment).
6. From time to time another backend service re-sync local DB groups with AD

Also, in today's World it's a bit unacceptable to release a new feature for Admins without the respective API endpoint.

As an Admin the first thing I have to think of is "how do I automate/integrate this thing with existing management tools, get out of the way of users and move to work on something else?"  Seems like Alteryx server is way too far from allowing that.

In our company, for years we have an API first design principle, that actually became a mandate two years ago.

Basically, if you design a new feature that come out without the respective API endpoint, you will have to explain why you did that and obtain an exception endorsement before putting that new feature at production use.