Sync AD users with AD group in Gallery

[Samuel_To]

Now, gallery does not support AD group , need to setup user one by one.

If gallery support AD group synchronization, it is more convenient for gallery admin to manage large number of users.

By assigning AD users to AD group, it will reduce the maintenance task of gallery admin, since gallery admin don't need to grant rights in the gallery directly. 

[george_allen]

I agree with this notion.  Establishing permissions for each individual user is less desirable than managing permissions at a group level. 

[rahulagrawal]

we have the same requirement in my environment as well.

[ajbee]

We also have this requirement

[KylieF]

Thank you for contributing to the Alteryx Community!

This idea is being set to implemented, though due to technical aspects of Server, will have limitations. The base feature requested has been a part of the Alteryx Server since at least 10.0 and allows Servers using Windows Authentication to assign permissions by AD group instead of user. This also allows for the sharing of assets or content with AD group as well.

However, there are some limitations to this, such as not being able to share data connections to AD groups and being unable to assign AD groups to a studios or subscriptions. Though we do provide the ability to preset users' permissions based on AD group prior to them logging in to the Gallery. We do not currently have any functionality that allows the mass importing of users or permissions, like some users would like to use the AD group for.  Rather all permissions are provided upon first log in based on their assigned AD groups permissions.

If this kind of mass importing functionality or other considerations are what you'd like to see added to the product, please feel free to create a new idea for it! A new idea will help us see how much support there would be for that functionality.

[Karam]

Hi @KylieF , 

Can I ask a quick question on the implemented feature please ... does this feature enable sync between AD groups and Gallery permission? i.e. if a user on AD has changed group, would that then change his/her role on the Gallery?

Many Thanks,

Karam

[dominicmander]

Hi @Karam @KylieF ,

Was there an answer to karam's question regarding changes in AD group after the user has first logged in?

@KylieFcan you clarify whether "first log in" in this case means:

- the first time they log in ever, and after that their permissions are forever based on what AD groups they were members of at the time

- when they first log in for a session, so if AD groups are added and they return the next day then they will have the new permissions

[JohnPelletier]

Hi folks,

We have some great news on this front. 

We've had AD group support for several releases now. However, it's been limited in a few ways, including that there has been no ability to share a workflow (RunAs) credential with an AD group and no ability to share a workflow to a data connection.

In 20.3 we released an ability to create a custom user group and assign a role to it.  

In 20.4 we've released the ability to also include an AD group as a member of a custom group.

Any users added to an AD group will automatically get the same permissions as any other member of the AD group and the AD group will stay in sync with the custom group of which it's a member. 

In 20.4 we also added the ability to share a collection with a custom group (sharing with AD groups has existed for several releases).

Also in 20.4, because AD groups can be a part of a custom group, we added the ability for a workflow credential to be shared with a custom group, and thus with any AD group that is a member of that custom group.

We realize you also would like to see similar functionality around sharing data connections, so we're working on it.

More to come...stay tuned.

[steven4320555]

Thanks for the comprehensive update @JohnPelletier 

At the end of your reply

"

We realize you also would like to see similar functionality around sharing data connections, so we're working on it.

More to come...stay tuned.

"

Is there a link to follow the update? or it will be shared here? Cheers

[adarsh2707]

Hi @JohnPelletier 
Along with giving user role feature, is there any way of setting the below parameters to a group of users, rather than a single user each time. Our client wishes to manage multiple users in one go 

[JohnPelletier]

@adarsh2707 , there is not currently a way to do that, but we might consider it for a future enhancement. The recommended practice for today would be to make a bulk permissions change by going to users, highlighting the users in your group and modifying their permissions in bulk. Not perfect, but hopefully workable until we get a chance to implement the group edits. See below the screen I'm referring to, which has yellow highlights for the important selections to be able to edit in bulk. If you want to put  your vote behind the group edits for this, please talk to your account SE so they can register your feedback through our Voice of the Customer channel. Thanks!