This site uses different types of cookies, including analytics and functional cookies (its own and from other sites). To change your cookie settings or find out more, click here. If you continue browsing our website, you accept these cookies.
The Alteryx License Server is an implementation of our technology partner Flexera Software ’s Local License Server , and allows for the deployment of a local license server within an organizations’ internal network. This allows for a smoother and more secure deployment of Alteryx products, especially behind proxies and firewalls.
Troubleshooting: Blank screen when configuring SAML authentication
In some cases you set up SAML configuration on Identity Provider (IDP) side as well as on Alteryx Gallery correctly, yet when you go through Alteryx System Settings the SAML authentication configuration will fail and show a blank logon window instead of redirecting you to the IDP's logon page.
SAML Authentication for Gallery
Identity Provider (third party app)
When configuring the System Settings for Gallery Authentication, when you click the Verify button it causes a blank screen to show up:
After clicking out of the pop up window you will see the below message.
Success! Default curator set to: undefined
The window is being prevented from showing the logon page for the chosen Identity Provider. Certain settings on the server machine can cause this, including but not limited to:
Internet Explorer Enhanced Security Configuration is enabled
The Identity Provider's URL (IDP URL in Alteryx System Settings - Gallery - Authentication) is not trusted (i.e. it has not been added to your Trusted Site List on the Gallery machine)
The Verify button is used to set the Default Gallery Curator - the user who logs in on this window in will populate this field in System Settings. Since the window is not showing due to one of the above causes, following the below steps as a workaround will manually set the Curator and enable you to continue to go through the System Settings.
Configure the System Settings Gallery > Authentication page. Set the Authentication Type to SAML Authentication and fill in the required fields.
Briefly switch the Authentication Type to Built-in. This will grey out the SAML fields, but keep the values you entered.
The Default Gallery Administrator section is now available. Type in the user's email address.
Switch the Authentication Type back to SAML authentication
Click Next button and continue through the System Settings
Once you continue through the System Settings, you should be able to log on to your Gallery via your Identity Provider.
As always if you encounter issues, please refer to the articles for setting up SAML below, or reach out to Alteryx Customer Support if you get stuck.
Configuring SAML on Alteryx Server for Okta
Configuring SAML on Alteryx Server for ADFS
Configuring SAML on Alteryx Server for PingOne
Internet Explorer Enhanced Security Configuration - Microsoft Help Doc page
Issue When publishing a workflow to Gallery with user credentials and you run into the following: Entering credentials has been disabled When configuring a new Gallery Data Connection the below error comes up when attempting to test or save the connection: Credential usage is disabled as a result of encryption configuration. Please contact your server administrator. Environment Alteryx Designer Alteryx Server Diagnosis You can verify this issue in the AlteryxService logs after a service restart. During the startup you will see a message like the following: ERROR,8912,AlteryxService,,,,,,,,"AlteryxService_InitLocalEncryptedStorage_Error: Error importing keys to Microsoft\Crypto\RSA\MachineKeys\ directory in ProgramData: Access is denied. (5)" Cause The Alteryx Service account has insufficient permissions to the server's machine key directory (%ProgramData%\Microsoft\Crypto\RSA\MachineKeys) or specifically the Alteryx Machine Key which is used to encrypt/decrypt user credentials and Gallery data connections. Solution Check your Service Log On As Account. The user set as the Log On As user (the default is Local System account) will need to have specific permissions. Run services.msc (CTRL+R, enter services.msc, and click OK) Locate the Alteryx Service and check the Log On As account Per the server help documentation, ensure the Service Account has Full Control over %ProgramData%\Microsoft\Crypto\RSA\MachineKeys** **If giving permissions to the full directory is not possible due to security reasons you can give it to just the Alteryx Machine key which starts with "3312". Also allowing Full Control over this machine key may fix the issue of the directory access does not. After granting permissions to the service account, restart the Alteryx Service
Introduction Does your organization have macros that users have developed to perform common and/or repeatable tasks within Alteryx? Does your organization struggle with how best to share those macros with the Alteryx Designer users and Alteryx Workflows/Apps which have been published to the Alteryx Server? Would you like to streamline the process of updating macros and utilize them through your Alteryx Workflows? Great, now let’s take a look at how we can easily achieve this within your Alteryx environment(s). As is common with many organizations, users within the organization have likely developed macros which perform various processes in Alteryx. These macros contain everything from simple to advanced data cleansing operations, core business logic, data manipulation tasks and much more. Once a user has developed a macro, we want to make it easy for them to share that with the rest of their Alteryx community. When it comes to using macros in Alteryx Workflows and Analytic Applications published to Alteryx Server, many organizations have questions about how to deploy those Workflows that utilize these macros. More importantly, when a change is made, how do they propagate the latest version of the macro to all of the published workflows? In this article, we will discuss the best practices around sharing macros. Using the methods outlined here, users will be able to make changes to Alteryx macros that are seamlessly propagated to other Alteryx Designer users, as well as Alteryx Workflows and Analytic Applications that have been published to the Alteryx Server. What are macros? Before we dive in to sharing macros, let’s define exactly what a macro is. Macros are a series of Alteryx tools built into a single workflow, that are bundled into a single tool that can be easily inserted into another workflow to perform common, repeatable tasks. Think about it as if you were taking an entire workflow and zipping it up into one Alteryx Designer icon, which you can then put into any other workflow. A perfect example of this would be to create a standard macro out of an analytic process you have to repeatedly create on a regular basis. Having this process in a macro form, allows you to then re-use that entire process in any number of other workflows without having to recreate the analytic process (or workflow) each time. This not only helps save time, but it also makes the entire process easily repeatable and protects you from forgetting any steps in that process. One key benefit to macros is, down the road, if there is a change to be made to that whole process, you only need to make that change in one workflow (macro), rather than chase down every instance that process was replicated. Macros are identified by a .yxmc file extension. There are four main types of macros with Alteryx: Standard Macros, Batch Macros, Iterative Macros, and Location Optimizer Macros. Standard Macros These macros, as mentioned above, are designed to package a process in a workflow as a tool that can be inserted into a workflow. Batch Macros These macros run multiple times in a single workflow, creating an output after each run. The macro runs once for each record, or selected group of records, in the data. This type of macro requires a Control Parameter tool to be used as an input. For additional information, see Batch Macros. Iterative Macros These macros run in the workflow the number of times set in the configuration, or run continuously until a specified condition is met. For additional information, see Iterative Macros. Location Optimizer Macros These macros are an iterative macro that can be used in network analysis to identify an optimal location or locations. For additional information, see Location Optimizer Macros. Sharing Macros Macros can be shared with users of the Alteryx Designer and Alteryx Server using a network file share. Permissions on who has access to the macros are controlled by permissions you define on the share. You can assign share permissions to users, groups of users, and computers to expose macros to Alteryx Workflows which have been published to the Alteryx Server. Once you have placed the macro in a network share, you can add a macro repository in Alteryx Designer. After adding a macro repository in Alteryx Designer, the macros will appear in the tool palette, and can be searched by using the search toolbar in Alteryx Designer. Creating a Network Share NOTE: The following is an example of how to create a network file share. It is not intended to be used in production environments. Depending upon the permissions defined on your network, it may be necessary to work with your IT department to have a network share created or permissions granted. Assuming you have the correct permissions to create a network share, proceed as follows to create a network share for macros: Open the Computer Management console on the file server Expand the Shared Folders section Right-click on Shares and select “New Share…” Follow the prompts in the “Create a Shared Folder Wizard” to create a network share NOTE: When creating the network share, you will be prompted to set shared folder permissions. Permissions allow you to control the level of access users, groups of users, and computers have on the network share. Permission Considerations Within an Alteryx Server environment, there are various ways workflows can be run. By default, all workflows will be run by a Local System account. However, you can configure Alteryx Server to run all workflows as a specific user in the Alteryx System Settings -> Worker -> Run As settings or you can require users to enter their domain credentials to run workflows. Depending upon the configuration of your Alteryx Server environment, this can dictate how permissions need to be assigned to the network share. Example 1: If workflows are running under the default system account, in addition to assigning permissions to the share for users of the Alteryx Designer, you will need to assign computer permissions to the share for each server in your Alteryx Server environment. Example 2: If workflows are running under a service account using the Alteryx System Settings -> Worker -> Run As settings, in addition to assigning permissions to the share for users of the Alteryx Designer, you will need to grant the service account access to the network share. Example 3: If you require users to enter their credentials to run a workflow in your Alteryx Server environment, in addition to assigning permissions to the share for users of the Alteryx Designer, each user with permission to execute the workflow will need permission to the network share. User and Group Permissions on Network Shares NOTE: The following is an example of how to assign user and group permissions on a network share. It is not intended to be used in production environments. To assign User and Group permissions, ensure the Users and Groups object types is selected in the “Select Users, Computers, Service Accounts, or Groups” dialog window. If either is not shown in the object types, click the Object Types button and select the Users and Groups object types. Computer Permissions on Network Shares NOTE: The following is an example of how to assign computer permissions on a network share. It is not intended to be used in production environments. To assign computer permissions, ensure the Computers object types is selected in the “Select Users, Computers, Service Accounts, or Groups” dialog window. If Computers is not shown in the object types, click the Object Types button and select the Computers object types. Shared Macros in Alteryx Designer Now that you have created a network share for your macros, and assigned user/group/computer permissions, it is time to create a macro repository in Alteryx. Once you have added a macro repository to your Alteryx Designer, the macros will appear in the tool palette and be searchable using the search toolbar. To create a macro repository, proceed as follows: Open Alteryx Designer Go to Options > User Settings > Edit User Settings and click on the Macros tab Click to add a macro repository In Category Name, type a name. Macros will appear in the tool palette under the Category Name defined here. The default name is Macros Click to browse to the location where you save macros on your computer or a network or paste the file path to the network share containing the macros Click the OK button on the “Add Search Path for Macros” dialog window Click the OK button on the User Settings dialog window Once you have completed the steps above, the macros will appear in the Alteryx Designer tool palette under the category name specified in step 4. NOTE: Sub-folders in a search path cannot be added individually if their parent folder already exists in the Macros repository. If you want sub-folders to display in different tool categories, you will need to remove the parent folder and add each sub-folder individually. Shared Macros in Alteryx Server To make the macros available to workflows published to your Alteryx Server environment, you will need to create the macro repositories on your Alteryx Server. To ensure the path to macros in workflows match between the Alteryx Designers systems and the Alteryx Server, the macro repositories will need to match those created on your Alteryx Designer users’ systems. To create a macro repository, proceed as follows: Open Alteryx Designer as an Administrator on your Alteryx Server Go to Options > User Settings > Edit User Settings and click on the Macros tab Click to add a macro repository In Category Name, type a name. Macros will appear in the tool palette under the Category Name defined here. The default name is Macros Click to browse to the location where you save macros on your computer or a network or paste the file path to the network share containing the macros Click the OK button on the “Add Search Path for Macros” dialog window Click the OK button on the User Settings dialog window Once you have completed the steps above, the macros will appear in the Alteryx Designer Tool Palette under the category name specified in step 4. NOTE: In a multi-node server deployment, you will need to create the macro repositories on each node. After creating a macro repository on one server, you can copy and paste the newly created .ini config file (located at C:\ProgramData\Alteryx\DataProducts\AddOnData\Macros) to the same path on each server in your Alteryx Server environment. Frequently Asked Questions Q. When I publish a Workflow to my Alteryx Server environment, do I need to do anything else? A. No. When you create a macro repository, Alteryx Designer sees macros contained within the directory as a “native macro” and references the macro using relative paths. When you publish the Workflow to Alteryx Server, the macro will continue to be referenced using a relative path based off the repository path defined in your Alteryx Server environment. You can verify that the macro is not being packaged with the workflow by checking the Workflow Options -> Manage Workflow Assets in the Save As dialog window. Q. I’ve made a change to one of my macros. How do I deploy the latest macro to all the published Workflows in my Alteryx Server environment? A. When you save the macro to the network share, it will automatically be updated for every workflow that references the macro in the macro repository you created. Q. I have multiple environments, dev, staging, and production. I would like to ensure changes to macros are properly vetted before being released to production. Will this work for my needs? A. Yes! For this to work, you can create a file share for each environment and assign the appropriate permissions to each environments file share. When adding the macro repositories to each environment, you can supply the environment specific macro repository path. When users make any changes to macros, they should save the new version to the dev file share. You can then test the updates to validate the changes before moving the updated macro to the staging and then production file shares. NOTE: To ensure a seamless transition between the Alteryx Server environments, it is important to ensure the folder/file structure matches in each of the environment-specific file shares. Q. Can I use a mapped network drive to share my organizations macros with Alteryx Designer users and Alteryx Server? A. As mapped network drives are mapped on a per user basis and do not appear to batch processes, using a mapped network drive will not work for sharing macros with Alteryx Server. It will, however, work if you are only sharing macros between Alteryx Designer users within your organization.
How to migrate from MMAPv1 to the WiredTiger Storage Engine In earlier versions of MongoDB (3.0 and earlier), the default storage engine used was MMAPv1. The WiredTiger storage engine was introduced in MongoDB 3.0 and is the default storage engine in MongoDB 3.2 and later. Two major benefits of the WiredTiger storage engine are: Document-level concurrency control for write operations which allows multiple documents in a collection to be updated at the same time Native compression which allows for more efficient use of storage space and less disk I/O Earlier versions of Alteryx Server shipped with MongoDB 2.6 and MongoDB 3.0 which defaults to using the MMAPv1 storage engine. If you installed Alteryx Server prior to the 2018.1 release when Alteryx Server was upgraded to MongoDB 3.4, it is highly likely that your Alteryx Server is running MongoDB using the MMAPv1 storage engine. To take advantage of the performance benefits of the WiredTiger storage engine you can migrate to the WiredTiger storage engine. This article documents the steps required to migrate to the WiredTiger storage engine by performing a backup and restore of the embedded MongoDB database. NOTE: The steps below only apply when using Embedded MongoDB with Alteryx Server 2018.1 and newer. If you are running Alteryx Server with a user-managed MongoDB, refer to the MongoDB help documentation. Prerequisites Product - Alteryx Server 2018.1 or newer with embedded MongoDB Procedure The first step is to identify which storage engine you are using. You can easily identify which storage engine is being used by reviewing the file system. Use the following Instructions to verify whether you are using the MMAPv1 or WiredTiger storage engine. Open the Alteryx System Settings Navigate to the Controller -> Persistence page Copy the "Data Folder" path Open Windows Explorer (File Browser) Paste the "Data Folder" path copied in Step 3 in the Address Bar of Windows Explorer If you see a series of "NS File" and "0 File" file types, as shown below, your Embedded MongoDB is running using the MMAPv1 storage engine If you see a series of "WT File" file types and a file named "WiredTiger", as shown below, your Embedded MongoDB is running using the WiredTiger storage engine and no further action is necessary Create an Embedded MongoDB Backup The steps below walk you through creating an Embedded MongoDB backup and restoring the backup to a new directory. For additional information on backup and restore best practices, refer to the additional resources at the end of this article. Log in to the server hosting the Alteryx Server Controller and embedded MongoDB database Open an elevated command prompt (Right-click -> Run as Administrator) Change directories to the Alteryx Server installation directory cmd: cd %ProgramFiles%\Alteryx\bin Alteryx Server installs to %ProgramFiles%\Alteryx\bin by default. If you installed to a non-default directory, update the paths accordingly as shown in the screenshots Stop the AlteryxService cmd: AlteryxService.exe stop The AlteryxService should report it stopped successfully, as shown in the below screenshot Perform a backup of the embedded MongoDB cmd: AlteryxService.exe emongodump=<Path to Backup Location> Proceed to "Restoring an Embedded MongoDB Backup" Restoring an Embedded MongoDB Backup Restore the embedded MongoDB backup to a new directory cmd: AlteryxService.exe emongorestore="<Path to MongoDB Backup>","<Path to Restore to>" Update the Data Folder in the Alteryx System Settings Browse to or enter the path MongoDB was restored to in the Data Folder field on the Controller -> Persistence section In the Alteryx System Settings console, click "Next" until reaching the "Finalize Your Configuration" screen Click the "Finish" button on the "Finalize Your Configuration" screen to apply the changes and start the Alteryx Service Verify the Alteryx Service started cmd: sc query AlteryxService Confirm the state returned is "Running" as shown in the screenshot below Verify MongoDB is running using the WiredTiger Storage Engine Open Windows Explorer (File Browser) Navigate to the new "Data Folder" path in Windows Explorer You should see a series of "WT File" file types and a file named "WiredTiger," as shown below. If you see "NS File" file types, confirm you completed the steps outlined in the article Now that you have completed the steps, your Alteryx Server is running embedded MongoDB using the WiredTiger storage engine - YAY! If you experience any issues with this process, please contact the Alteryx Customer Support Team for further assistance. Additional Resources For additional information on managing embedded MongoDB, refer to the Alteryx Server Help topic on MongoDB Management For Alteryx Server Backup and Recovery best practices, refer to the following Community articles Alteryx Server Backup & Recovery Part 1: Best Practices Alteryx Server Backup & Recovery Part 2: Procedures For user-managed MongoDB deployments running MongoDB 4.0, refer to the following MongoDB documentation MongoDB Production Notes Change Standalone to WiredTiger Change Replica Set to WiredTiger Change Sharded Cluster to WiredTiger
Configuring SAML on Alteryx Server for OneLogin
Alteryx Gallery allows the use of most Identity Providers (IdP) that support the SAML 2.0 standard to be configured as an authentication method.
The following information will assist with configuring Alteryx Gallery to be functional with OneLogin.
Account with access to perform administration tasks
All users that will login must have an email address attribute
Alteryx Server >= 2018.2
Account with access to perform administration tasks
In the OneLogin Administration screen, highlight Apps in the top navigation menu and select Add Apps.
On the Find Applications screen, search for SAML in the box provided. One of the results should be OneLogin SAML Test (IdP). Select that application.
Fill in the name, description, and details for the Alteryx Gallery. Then, click Save.
Highlight the More Options button that appears and download the SAML Metadata file. You will need a few values in this file when configuring the System Settings on the Alteryx Server side.
Click Configuration in the navigation menu. Fill out the details with your base Gallery URL and the attached endpoints: /aas/Saml2/Acs or /aas/Saml2 appended to the end. If you have SSL configured with the Alteryx Gallery, use https:// instead of http://. With the ACS URL Validator, copy the SAML Consumer URL and escape and metacharacters in the address. Note: The endpoints may be case sensitive depending on settings in your environment. I would recommend entering it with the capitalization as shown in the screenshot and example URLs below.
Base URL: http://mygallery.alteryx.com/gallery/
SAML Consumer URL: http://mygallery.alteryx.com/aas/Saml2/Acs
SAML Audience: http://mygallery.alteryx.com/aas/Saml2
SAML Recipient: http://mygallery.alteryx.com/aas/Saml2
ACS URL Validator: http:\/\/mygallery.alteryx.com\/aas\/Saml2\/Acs When finished, click Save.
Under the Parameters section we need to map the Claims attributes to match between Alteryx Gallery and OneLogin. Use the below table for the appropriate values between the two. The Alteryx Gallery Attributes are case sensitive.
Alteryx Gallery Attribute
Note: OneLogin provides a starting Field you can modify, Email (NameID), ignore this as the email setting we need, maps to a different value.
Select Include in SAML assertion.
Duplicate the above for firstName and lastName. When finished, click Save.
In the SSO section, switch the SAML Signature Algorithm to SHA-256. When finished, click Save.
Open the Alteryx System Settings and click Next until Gallery->Authentication section. Also, open the OneLogin metadata XML file you downloaded earlier.
Set the Select an option for obtaining metadata required by the IDP to X509 certificate and IDP SSO URL. The IDP URL can be found in the OneLogin metadata XML file at the EntityDescriptor setting, under EntityID. It should look something like: https://app.onelogin.com/saml/metadata/12345678-1234-5678-1234-123456789012.
Use the SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST value at the bottom of the XML document for the IDP SSO URL setting.
You will also need the value from the X509 Certificate for the corresponding setting. It is more reliable for the connection between the Gallery and the IDP if the certificate is entered as one long string rather than the text block provided in the XML document.
Click Verify IDP in the Alteryx System Settings. This will prompt you with the OneLogin login screen. Fill out your OneLogin username and password.
If everything is set up correctly, you will see a success message and your email address filled out in the Default Gallery Administrator setting.
Access Denied error -Verify the user account has access to the OneLogin application. You can verify this at Users->(user account)->Applications AlteryxAuthorizationService.exe has stopped working or there is a failure to set the Default Gallery Administrator -Turn off IE Enhanced Security Configuration on the Alteryx Server if you have crash errors while verifying the IDP information. This feature can be turned back on once you have the configuration in a functional state. https://www.limestonenetworks.com/support/knowledge-center/17/70/how_do_i_disable_internet_explorer_... -Verify that the values in the SAML IDP Configuration are correct for your OneLogin application. -Verify that the OneLogin application was configured with the correct claim attributes. -Check the AlteryxAuthorizatonService.exe logging directory ( %PROGRAMDATA%\Alteryx\Logs ) for any clues. -Open Event Viewer within Windows and look for errors that may be of use in the Application log. -If still stuck, reach out to our Support team . I'd suggest providing the following: 1. Values set in the Alteryx System Settings application for SAML 2. AAS log files (found in %PROGRAMDATA%\Alteryx\Logs\) 3. Configuration screenshots for OneLogin
When running or publishing a workflow that uses a Gallery Data Connection.
Unable to translate alias
This error can be seen when running/opening a workflow on Designer
Or when publishing the workflow to Gallery
Or when running the workflow on Gallery
Confirm that the data connection that you are using is a Gallery Data Connection:
In Designer select Options > Advanced Options > Manage Data Connections
The alias that you are using should have a type of 'Gallery'
If you do not see a Gallery connection and want to add one, please see the article Database Connection Share Through Gallery Admin for instructions.
Gallery Connection Sync issue (often occurs after upgrading Alteryx Server)
The Gallery Data Connection is shared with a Private Studio rather than explicitly with the workflow owner (the error will only occur on scheduler)
Open a File Explorer
Navigate to %APPDATA%\Alteryx\Engine
Delete or rename GalleryAlias.xml
Re-launch Alteryx Designer
If the issue only occurs on your Scheduler and runs fine everywhere else, the Gallery Data Connection needs to be shared explicitly with the owner of the workflow rather than their Private Studio/Subscription.
When sharing the connection, you can differentiate a Studio with User Accounts by checking the following:
Default avatar is a single silhouette
User membership icon will appear on the right
User's email will show
Why can't a user run a workflow in Gallery that uses a shared data connection?
As always, don't hesitate to contact us over at Customer Support if you run into any trouble.