Data Connections Good or Evil

[mercra]

We're at RGA and using Alteryx and have a bit of a love/hate relationship with Data Connections.

Is anyone using data connections and are you happy about it?  

Two worries we have:

1) we heard some changes to the dc require republishing workflows.  We haven't gotten specifics, but looking into it.

2) we have data connections where we want to have the WF write to it, but we don't want all users that can run the WF access the data connection directly in designer.  with 2020.2 you have to give users access to the data connection which allows them to access the data connection in Designer for adhoc access.   

Any experience anyone has is greatly appreciated.  

Thanks,

Craig

[ADerbak]

Hi Craig, 

   I haven't experienced any data connection issues yet, but I am curious to hear what issues you come across. For your second point, I think this could be handled at the endpoint if you have control over it. For instance, if you are writing to SQL Server, the login credentials should determine permissions to read or read/write (e.g. Craig's database credentials allow him to write, but if Andrew runs the workflow, it will error).

Please let me know if that helps or if there is any more details you can provide.

Kind Regards,

Andrew Derbak
Senior Data Engineer

See my journey at "Fuzzy Logic Blog"

[mercra]

Thanks for the reply.  I think this is one of our confusion points.  For our data connections we are specifying a db username and password.   Any user using the workflow will access the data using that username/password - correct?

Even if we set a RunAs on the workflow, the data is still accessed with the data connection permissions we've applied - correct?

So... if we setup a db user that has write permission to a table, and give a user access to that data connection because they run a workflow that uses that data connection, then that user via designer could adhoc query access our db via the alteryx data connections with the access granted to the data connection user...  Seems like a gap in security so I figure we're just missing something.

Thanks,

Craig