Owners have specific rights on their content you can't remove. The action includes:
- Refresh Extract
- Change Owner
- Set permissions if not locked to the project
Actually, I found in the documentation that owners get full access to theirs content (How Permissions are Evaluated).
We would like to remove these rights too, so I am interested in an answer if any solution exists.
yeah, I kind of figured as much. I really want to have the download ability for owners who create content online removed. There won't be a need for our users who create content online to download their books, they should only be allowed online usage.
Hopefully, someone else can help clear up a better way to get this accomplished. I need to have users have the ability to create books online, but NOT be able to download them.
2 of 2 people found this helpful
A content owner of a Workbook or Published Data Source has 'full rights' of that object.
AFAIK, there is no way to restrict this.
The only option is to change the ownership of that object to another account, so that that the publisher only has 'normal' rights. Using a unlicensed account is a good option, so that only admins are able to download.
This can only be done after something has been published, though.
By querying the repository, you could build a dashboard showing workbooks where the ownership is not correctly set, and manually change them.
Or, you can use the REST API to script this process, so that it can be done on a schedule.
Hope this helps
Thanks Glen !
So, I need to bring the back up to see if there is anyone else that can help shed light on preventing workbooks from being downloaded off our TS.
It seems that the 'deny' permission shown below for the download workbook / save as is being over-ridden by some other permission. I have had users who are able to see a download workbook option
I have had users that appear to be able to dl a book by using the 'download' icon next to the workbook name (the box with the down arrow).
I need this feature to work when the permissions are explicitly set to deny this ... how do I go about removing this? If the permissions won't work like expected, then can I do something to 'hide' or 'remove' this icon ?
I have just checked on Tableau 2018.1 and this appears to be working as expected.
Can you confirm that the users who are able to download arent admins, project leaders, or content owners?
Also, what version of Tableau Server are you running? As it could be a bug in that version
All the best
I'm running TS 10.4. The users are not set to admins or project leaders and I'm the only owner of all the data sources. All users are set with custom permissions based on groups. The snapshot above with the permission settings is what we have been rolling out for our 'publisher' group. We do not use the default project leader permission group.
Our users should be able to connect to a DS, build a report and save it to a certain project. Once they do that, they become the owner of that workbook - not the DS. Without them being the owner of the book, they are not able to 'save'. Thus, if i was to change all workbooks created to a 'generic' owner - they would not be able to modify their books anymore.
Sorry, not sure that I follow what you are saying...
Are you saying that the user who builds a workbook, is able to download THAT workbook? If so, this is expected behavior as they are the owner of that workbook. However, for other workbooks in that project, they should have the permissions specified (as above)
Maybe I didn't fully qualify that earlier So, we do not want to allow users to use desktop to work with our data. Our environment is setup to be fully web based, meaning that everything is only done on the server through web edit. But, yes, a user who connects to a data source online by using the web editor to create reports / books then becomes the owner of that book. The permission that denies the ability to download is what I'm confused about - regardless if it is a owner or view. The other permissions work fine when they deal with other book on the server that other users have created using the web editor.
I hope the Tableau Server team read this issue.
I also have the same problem, somehow it doesn't work because the publisher is the owner. The worst is, in my case, my publisher user only create a blank dashboard to download the datasource (in csv/crosstab) and create the report in excel.
I hope there is also a permission setting in datasource whether user can download detail data or not.
still lookin for the solution
Is this still being worked? or at least discussed. We have users who we are happy to see and use,save, publish the data, but it needs to be locked in the environment for security reasons. It seems crazy that there is no way to let someone be publisher but prevent them from downloading data (at least from an admin perspective). We might have to look at other solutions because management of this is to cumbersome. I would hate to go that way. Any luck from others out there navigating this issue.
Agreed it can be a real minefield at times. Other things to test/check
1) the permissions set against the published datasource itself - can the datasource be downloaded
2) the credentials of workbook and datasource. If embedded credentials are used, then it might be the viewer is connecting to data based on the permissions of the owner Permissions Reference - Tableau , and if so, it might be that those credentials allowing download too....
These are just other thoughts for now - haven't tested any of this thoroughly myself or had to deal with the issues associated to this.
Is the option to show views as tabs disabled? In that case the workbook level settings would not propagate to the views and the download button will still be visible.