Alteryx Server Ideas

Share your Server product ideas - we're listening!
Submitting an Idea?

Be sure to review our Idea Submission Guidelines for more information!

Submission Guidelines
Nominations are open for the Alteryx Excellence Awards through March 26! We want to celebrate the impact you've had and give you the visibility you deserve! Make your submission here.

Alteryx Gallery API running as an account

In the Alteryx Gallery UI, it's possible to set up workflow credentials so that a workflow published to the gallery runs as a specific user.  

 

Unfortunately when that workflow is run from the Alteryx Gallery API, it appears to only ever run as the Alteryx Server Run-As account. 

 

Our developers in working with this figured out that if they called the (undocumented) API that runs the actual Alteryx Gallery directly, they can achieve what they want, but it seems a risky strategy.

 

The idea would be:

-Either unify the APIs so that the Gallery itself uses the same API to run workflows as what you present as the "Gallery API" (the eat your own dogfood way)

-Alter the Gallery API to enable us to run as a different workflow credential

 

Without this, we're forced to permission the run-as account to access anything that uses this method, which in turn then becomes a bit of a security hole (any workflow run will have access to everything that the run-as account uses) 

40 Comments
piotrzawistowski
8 - Asteroid

I was about to create a ticket for the same. We really need this functionality. 

 

Currently it is impossible to use external scheduler/orchestrator (like Airflow) and have a good level of security which is guaranteed by AD groups.

MattCooper
5 - Atom
+1 we need this feature too.
TanyaS
Alteryx Alumni (Retired)
Status changed to: Accepted

Congratulations! We have accepted your idea. Look for this idea to be implemented in an upcoming release.

CiaranA
9 - Comet

@michael_renwick @TanyaS 

Good news! Please keep us posted.

DataVizionary
7 - Meteor

+1

 

Must have!

brianturner
6 - Meteoroid

+1, this would be more secure and allow more granular access to be able to have API calls go through a subscriptions' default credentials and not all subscriptions going through one set of credentials.

piotrzawistowski
8 - Asteroid

Hi Tanya,

I do not see this change in release notes:

https://help.alteryx.com/release-notes/server/server-20201-release-notes

 

Can you please confirm that the fix is delivered with the 2020.1 version?

 

Thank you,

Piotr

brianturner
6 - Meteoroid

@piotrzawistowski I recently submitted a case on this - they did not indicate that it was being fixed in 2020.1, nor give a specific release where it might be.  Anyone have details on workarounds?

CiaranA
9 - Comet

@piotrzawistowski @brianturner  the only workaround is to use the Admin API Key & Secret, and enable the underlying (default) service account the permissions any workflows need. Not ideal when you have multiple Teams using the Gallery. 

piotrzawistowski
8 - Asteroid

@brianturner@TanyaS published such info:

"Congratulations! We have accepted your idea. Look for this idea to be implemented in an upcoming release."

So I was hoping that she meant 2020.1.1