1 2 Previous Next 15 Replies Latest reply on Feb 15, 2017 4:08 AM by Selva Sivaprakasam

    Forbidden Action ... Guests must have Connect permission?

    Ashley Lambert-Maberly

      Hi,

       

      New, with new people at the Server end.  So I don't trust their advice necessarily, plus, their suggestions aren't working.

       

      Have published a dashboard to our web site at www.pair.ubc.ca/tableau/timetocompletion.shtml  It's quite pretty ... if you could see it.

       

      Instead of it loading, I'm getting a box saying "Forbidden Action: To access this workbook you must have the Connect permission for its data sources.  Because you are logged in as Guest, you do not have this permission.   Log in as a named user to try again."

       

      (Of course I can see if through logging in to the server, but I want the world to be able to see it, not just me).

       

      1)    My server person suggested changing permissions for Guest on the workbook and each view, to allow "Connect."  I did, and we still get the Forbidden Action box.

       

      2)     I have trouble believing if you publish a dashboard based on a published data source, that you have to allow people to connect to the data source in order to see the dashboard--surely you can let people View and play around with a Filter without having to enable Connect?  (I get that, in some sense, the dashboard must be connected to data otherwise it would show nothing, but then wouldn't allowing "View" imply a "Connect" otherwise View is pointless). 

       

      Any advice would be helpful.  Clearly she, I, or both of us are fundamentally misunderstanding something.

       

      Thanks,

       

      Ash

        • 1. Re: Forbidden Action ... Guests must have Connect permission?
          Ashley Lambert-Maberly

          Replying to self--republished, changed permissions at the time of publishing rather than after going to the server web site, and voila, it's visible. Still not sure why it doesn't work when changing permissions through our server interface, though!

          • 2. Re: Forbidden Action ... Guests must have Connect permission?
            Russell Christopher

            Hey Ashley -

             

            You must indeed grant permissions for a user to leverage a Data Server data source on Tableau Server - normally this is accomplished by adding the user and/or group to the Data Source Connector role.

             

            Doing so allows the user/group to see (View) and use (Connect) the data source, If you don't do this, a user may have permissions on a report, but when the report tries to connect to the data source on the user's behalf (and can't), the report execution will fail. This is by design so an administrator can quickly deny permissions to a data source for a specific user/group and disallow it's use across ALL reports which leverage it.

             

            Your next issue has to do with the fact that you're trying to GRANT the permissions in question to the Guest User. We don't allow that. Here's what happens if you look at the permissions on a data source for the GUEST user after adding them to the Data Source Connector role:

             

            ScreenHunter_04 Sep. 19 15.35.gif

             

            Note that even though "Guest" has been added to "Data Source Connector", they are STILL denied the permissions due to licensing restrictions.

             

            I'm actually not quite sure WHY we think granting this permission to Guest is such a bad thing - I'm checking now as I'm very curious. Will let you know.

            • 3. Re: Forbidden Action ... Guests must have Connect permission?
              Russell Christopher

              Now THAT is interesting. Going to try that myself - potentially a bug. What permissions did you apply to the report when publishing? Or did you re-publish the data source first? If so, what permissions did you apply to the data source from Desktop when publishing?

               

              Thanks!

              • 4. Re: Forbidden Action ... Guests must have Connect permission?
                Ashley Lambert-Maberly

                Thanks so much for taking an interest!  I'm desperate!

                 

                I republished, overwrote the earlier workbook, and just set its permissions to Guest - Viewer, the default for Viewer.

                 

                Didn't republish the data source, which is already set to Connect for them (or not, depending how you look at it).

                 

                Here's my fundamental puzzle:  I want to publish a Dashboard the world can view, and maybe filter on.  Like a bazillion other dashboards out there, so I'm sure it's doable.  I don't want to rely on a bug or happy accident for this.  How do I accomplish this?  It would seem to me that ordinary dashboard, visible by anyone who stumbles across my web site, would be straightforward, and that suppressing stuff that's sensitive would require some extra effort.  How do I just publish an ordinary dashboard, so people can see it?

                • 5. Re: Forbidden Action ... Guests must have Connect permission?
                  Russell Christopher

                  Very strange, I'm going to have to try that - the issue is that you MUST have Connect permissions on the Data Source - and you can't really grant that permission to Guest. Are you sure that when you viewed the report last time around (and it began working), you were doing so as "Guest" vs. using your own (cached) credentials? To be sure, logout of Tableau Server, close the browser and navigate right to http://YOURSERVER/views/WorkBookName/ViewName

                   

                  I'm actually seeing exactly what you initially described - the Data Server data source is pretty much getting in the way of what I want to do (enable anon access to a report which uses the data source).

                   

                  If you just want to get on with your life, create a report which uses a local (embedded) data source instead. For example, hit this link and you'll run a viz as Guest on my server:

                  • 6. Re: Forbidden Action ... Guests must have Connect permission?
                    Ashley Lambert-Maberly

                    Turns out our firewall is preventing non-university people from seeing the viz, so that'll stop you and most people--for now, until they fix that.  But it works for UBC non-Tasbleau people, I just stood over the shoulder of one and saw the viz on her web page.

                     

                    So you're saying for very public dashboards, one should not use published data sources (I was told at the conference that published data sources were awesome because they retained my aliases, renamings, groups, calculated fields, etc.) ... but they're no good to me if they prevent people from seeing the dashboard.

                     

                    Is there some extra step ... like I connect to Oracle, extract my data, rename, group, caculate, etc., publish to Server.  Then I open a workbook, connect to the saved source, do my viz, and when it's time to publish I should ... what, recreate an extract or something?  Packaged workbook?  Publish that?  Is that how I get around it?  (I thought packaged workbooks were just for people using Reader, but maybe there's more to them)

                     

                    Sorry to be so confused/demanding/dumb.

                     

                    Ash

                    • 7. Re: Forbidden Action ... Guests must have Connect permission?
                      Russell Christopher

                      Ashley Lambert-Maberly wrote:

                       

                      Turns out our firewall is preventing non-university people from seeing the viz, so that'll stop you and most people--for now, until they fix that.  But it works for UBC non-Tasbleau people, I just stood over the shoulder of one and saw the viz on her web page.

                       

                      ... I haven't tried this myself yet, about to. Still doesn't make sense why it would work when permissioning from Desktop but not from inside the Portal..

                       

                      Ashley Lambert-Maberly wrote:

                       

                      So you're saying for very public dashboards, one should not use published data sources (I was told at the conference that published data sources were awesome because they retained my aliases, renamings, groups, calculated fields, etc.) ... but they're no good to me if they prevent people from seeing the dashboard.

                       

                      Nope, not saying that, actually. You SHOULD be able to use published data sources, for all the reasons you list. However, it seems the combination of Guest user and published data sources don't play well - trying to find out why.

                      • 8. Re: Forbidden Action ... Guests must have Connect permission?
                        Russell Christopher

                        Yeah, there's something wrong here.

                         

                        If I:

                         

                        • Use Desktop to create a report with a Data Source published on Server
                        • Publish the report and give Guest Interactor permissions

                         

                        ...then it works.

                         

                        If I:

                         

                        • Use Tableau Server's Web Authoring capability to create a report off the SAME data source
                        • Save the report on the Server and then use the Portal to grant Interactor permissions on the report for user Guest

                         

                        ...then it fails.

                         

                        We should get the same behavior in both instances. I think the latter behavior (it won't work) is the correct one based on the fact that we automatically DENY permissions on Data Sources for Guest. Don't know why it's working from Desktop...or I could just be altogether wrong.

                         

                        Off to file a bug! We'll let a smart developer figure this out

                        1 of 1 people found this helpful
                        • 9. Re: Forbidden Action ... Guests must have Connect permission?
                          Ashley Lambert-Maberly

                          Thanks so much.  I changed the Guests from Viewers to Interactors and now my filters have appeared (didn't notice they were missing before, I was just so pleased to see the dashboard finally show up).  I'd assumed if I'd said Filter = Allow that Viewers would get to filter, but no such luck ;-)

                           

                          Glad to have found a bug after 3 weeks of using Tableau--it's my special talent.

                          • 10. Re: Forbidden Action ... Guests must have Connect permission?
                            Michael Nied

                            I am using Tableau Server v8.1

                             

                            I ran into what appears to be a similar issue and I found a solution for my problem.  See if this works for you.

                             

                            I published a work book on my server that was connected to a tableau data source located on the server. Admins could see the workbook and its views however other users who had the correct permissions could not see the views.  I tried many things but ultimately I noticed that the when I was connected to different workbooks there was different connections on the top corner above the menu bar: one (workbook that worked) said "Tableau-(Workbook name)-[on "server name"]" the other one said LOCALHOST 9100.  The workbook with errors had the 9100 data connection.

                             

                            After this I made a new workbook and I connected it to the same data source from the server and redid my dashboards from scratch.  This new copy worked.

                             

                            I assume that there was some corruption that occurred at some point with my data source connection attached to the workbook.



                            Hope this helps.

                            • 11. Re: Forbidden Action ... Guests must have Connect permission?
                              Tim Quayle

                              I ran into the same issues described throughout this thread. I attempted to give guest user extensive permissions at the workbook, data source and containing project levels from Tableau Server, remembering to "assign permissions to contents" each time --but still no luck. So then I went to republish the workbook as instructed in this thread and I noticed that credentials were set to "prompt user" in the publishing dialog. After changing credentials to "embedded", I republished without tinkering with any changes to permissions in the publishing dialog (guest user interactor permissions were inherited with the project) and it now works fine.

                              • 12. Re: Forbidden Action ... Guests must have Connect permission?
                                Matt Harrison

                                Hi Russell (et al),

                                 

                                I'm wondering if there have been any further development on this potential bug. I am currently seeing this issue using a Shared data source to Teradata. I've tired it on both Serve 8.0 and 8.1 with no luck.

                                 

                                Here are the details:

                                On the server we have all AD groups set with the Connect permission as "Allow" at the project in question. In addition, all members are given the connect permission on this specific Published Data Source. In addition, all users are also given Interact permissions to the workbook that uses this data source.


                                The specific issue i'm seeing is that users are able to connect to the shared data source in Tableau Desktop, but when any workbook that uses this data source is published we get the below forbidden action error.

                                Forbidden Action.JPG

                                Our goal here is to allow for users to share content on the Server that leverages a controlled data source (we don't want people changing formulas in data sources!).

                                 

                                I don't believe there are any other needed permissions. I'll also note that the WebEdit feature has been set to Deny in this server; however, I wouldn't expect this permission to prohibit leveraging Shared Data Sources in published workbooks on the server.

                                 

                                Thanks!
                                Matt Harrison

                                • 13. Re: Forbidden Action ... Guests must have Connect permission?
                                  Sean Mullane

                                  Can we recap on the expected behavior here? I'm encountering the same issue (user has View permission but not Connect permission, gets a "Forbidden Action" error), although in my case these are named users with a 'Custom' role  rather than Guest users, on Server 8.2.0.

                                   

                                  Is it supposed to be the case that the user needs the Connect permission to view a workbook with a separate data source? If this is a bug, in what version was it fixed, if at all?

                                  • 14. Re: Forbidden Action ... Guests must have Connect permission?
                                    Toby Erkson

                                    Sean, your issue is with a named user, not Guest, so let's keep the issue in the thread you created.

                                    1 2 Previous Next