8 Replies Latest reply on Nov 18, 2013 9:20 AM by Cliff Corder

    Server Admin - managing workbook permissions

    Lily Chen

      Hi Tableau gurus,


      I'm wondering if anyone has any good ideas regard managing permissions at workbook level?


      As you know, if the publisher changed the permissions when publishing the workbooks, the new permissions will overwrite the default project permission. I know that we can check the permissions by selecting the workbook, however, it is not easy to manage / audit when having tons of workbooks within multiple projects.


      By looking into the internal postgres database, it doesn't seem to have a permission table nor permission indicators in workbooks / projects tables that we can easily create report from.


      Any idea, suggestion, experience sharing are highly appreciated!




        • 1. Re: Server Admin - managing workbook permissions
          Toby Erkson

          Instead of looking at each workbook you can just force the permissions set at the Project level.  At some given time interval (once a week or twice a month or etc.) open each Project and "Assign Permissions to Contents":

          terkson - Wednesday, October 30, 2013 9_51_56 AM - Permissions_ Workbooks.jpg

          I don't know if this can be done using tabadmin or tabcmd.  If so then you could have a scheduler execute a batch file for this process.  It doesn't look like this is possible using tabcmd

          • 2. Re: Server Admin - managing workbook permissions
            Cliff Corder

            I am by no means a guru. I've poked around some in postgres and from the views accessible through the "tableau" account I don't think there's anything to find. But if you can get in through the tblwgadmin account (you may need to be actually on the machine to access with that account) you can see the tables. I see one called next_gen_permissions. There is an authorizable_id that is the id of a workbook. You may need to also clarify that authorizable_type = workbook. This will show various "capabilities" for that workbook. There is also a capabilities table that defines those capabilities.


            This is as far as I've made it. My next question is if there is a history somewhere. I'm having instances of permissions dropping from a workbook and can't tell if the publishers are doing something or the system is doing something.

            • 4. Re: Server Admin - managing workbook permissions
              Lily Chen

              Hi Toby,


              Thanks for your reply.


              Unfortunately, we won't be able to force the permission from Project down to Workbook as it will overwrite the existing workbook permissions.


              By looking into the the posgres database using tblwgadmin account, we've generated the view for permissions and created the reports using it.


              However, as mentioned by Cliff Corder, the report is a live report, we can get the historical information of the permissions. For example, if some publisher accidentally changed the workbook permissions and we want to restore the permissions back. Where can we get the historical permission records is still a question to figure out...

              • 5. Re: Server Admin - managing workbook permissions
                Lily Chen

                Hi Cliff,


                We now having same question as you do regarding of historical permission records.


                What we had tried was create reports of the permissions and set email subscriptions to keep the record as image. However, the email subscription image is not readable when the list is too long and it took extremely long time to render which is not healthy practice for server.


                Using the export button on the report is much faster. It also provides the full list as an image. Now I'm looking into scripting solution to run the export. If anyone has a clue to share, please let us know

                • 6. Re: Server Admin - managing workbook permissions
                  Cliff Corder

                  Hi Lily,


                  I again have some untried advice. There is a tabcmd called "export". Just brainstorming that you could set that up on a windows schedule that would nightly create the exported image that you want. There thing we're sorting out is that in order to use the tabcmd export you have to first use tabcmd login. The issue with login is that everything is plain text, including the password. Since we're sensitive to passwords out in the open that isn't an option. Right now we're exploring building a little c# application that wraps these command and provides for password encryption.


                  Hope this helps.



                  • 7. Re: Server Admin - managing workbook permissions
                    Toby Erkson

                    Cliff, check out Jim Wahl's first response here.  It may save you some time.

                    • 8. Re: Server Admin - managing workbook permissions
                      Cliff Corder

                      Yes, that's a good option. I'd seen that before. We happen to have several folks that can quickly throw together something with C# instead of the powershell route. I think both are viable.