4 Replies Latest reply on Jul 15, 2016 3:19 PM by Eric Liong

    Merge Permissions Groups

    Eric Liong

      So here's the situation.

       

      We have two groups. One was an old local permissions group that was created with a BAT file created by a previous admin. The other is our new Active directory group.

       

      The problem is that a number of people have added permissions explicitly allowing or denying the Local BAT group and we are hoping to do away with this process to simplify what we have to do when we're porting server boxes. If I do away with the BAT file, the group and permissions attached to it will become out of date.

       

      Is anyone familiar with a method of merging permissions groups? There are far too many to change manually.

       

      Thanks for your time!

        • 1. Re: Merge Permissions Groups
          Glen Robinson

          Hi Eric

          Not 100% sure what you are after.

          It reads to me that you are looking to merge the members of 2 groups into one. Is this right?

          Is the group you are merging into in Active Directory or a Local Group in Tableau?

           

          Regards

          Glen

          • 2. Re: Merge Permissions Groups
            Eric Liong

            Hi Glen thanks for your response!

             

            We're trying to merge the permissions of both groups into one. Both Groups have identical members. One is active directory and another is a Local Group in Tableau.

             

            Both have existed for a little while but we plan on killing the process that added people to the Local group. Unfortunately a number of people added workbook permissions specifically allowing or denying the local group.

             

            I'm trying to find a way to merge these two sets of permissions together.

             

            Cheers,

            • 3. Re: Merge Permissions Groups
              Glen Robinson

              Hi Eric

              Thanks for clarifying.

              So it sounds to me that you effectively need to complete the following

              For each Workbook,

              - Get Current Permissions

              - If the local group is permissioned against it, get these permissions and assign them to the Global Group

              - Remove the local group permissions.

              Repeat until all workbooks have been updated.

               

              I am assuming that you arent using the 'Lock to Project' permissions feature that is available from 9.2 onwards.

              Is this an opportunity to review all your security and look at rebuilding so that you can use this feature, and stop Publishers from directly assigning permissions against workbooks. (Having permissions at the project level is a much more manageable option.)

               

              If it is a case of you 'just need to get this done', your best option for doing this programatically would be to use the REST API

               

              https://onlinehelp.tableau.com/current/api/rest_api/en-us/help.htm

              With this you will be able to perform all the tasks you need to do; List all the workbooks, Query the Workbook permissions, Update them for the global group, and remove them for the local group.

               

              Let me know how you get on, or if you need some specific help

               

              Regards

               

              Glen

              2 of 2 people found this helpful
              • 4. Re: Merge Permissions Groups
                Eric Liong

                Currently currently digging into the REST API, pretty green so wish me luck. Thanks for the help so far Glen. Will send an update again when I have a chance to learn, build and test something out. Cheers.

                 

                Regarding the other methods...

                The only issue here is that I have at least 50 workbooks if not a hundred that have been assigned to the group we're trying to remove.

                 

                We've looked at project based permissions but we're in healthcare and a number of the workbooks have very specific permissions to Eg the diagnostics group here or the cancer group there. To avoid having hundreds of projects we've settled on security based off individuals.