0 Replies Latest reply on Oct 22, 2019 1:20 PM by Micah McClelland

    Data Blending w/ Security Table breaks when removing security paramter field from View

    Micah McClelland

      Tableau Version: 2019.2.1 Desktop Professional

       

      Hello All,

       

      First let me say, I know there are many other ways to implement User Security. This is a POC for work, trying to implement security in this manner. We can't do Cross DS Filtering, and already do Row level cartesian-style in other projects but our scale is too large to continue. We are trying to find an easy way to 'drop in' a security table as a new datasource to any previously existing workbook and apply user-based security, ideally without rebuilding the entire thing and without relying on modifying the existing datasources.

       

      I have searched extensively and found only one other post where someone has the same behavior I'm trying to workaround (back in 2015):

      Re: User Filter with Secondary Data Sources

       

      The problem:

      I have a primary datasource that I am trying to blend with a secondary datasource to implement User Security. I have it all working by having username fields in both datasources and using that field for blending: sec_user=username().

      My primary is my Viz data, and secondary is the security table with 1 record per User that includes allowed Geo and Manager names.

       

      My security formula, created in my Primary, checks if fields are NOT Null and if the datasource field values are contained within the security fields. Null here means access to everything is allowed:

      if not ISNULL(ATTR([securitycurrent].[Sec Geo])) then

      CONTAINS(attr([securitycurrent].[Sec Geo]),attr([Bkg Geo]))

      else TRUE

      end

       

      AND

       

      if not isnull(ATTR([securitycurrent].[Sec PBM])) then

      contains(attr([securitycurrent].[Sec PBM]),attr([Manager]))

      else TRUE

      end

       

      Here is security table for User=tonytableau - he can access anything where GEO is AMER or EMEA and the Manager is John Doe or Jim Jimmy:

      UserSec_GeoSec_Manager
      tonytableau"'AMER','EMEA'""'John Doe','Jim Jimmy'"

       

      Blending and using my calculated field to check permissions works, so long as the dimensions (GEO/Manager) used in my security formula are part of the view. As soon as I remove GEO or Manager, the security breaks and I no longer see anything.

       

      Bookings by Manager and GEO (TRUE means security cleared, FALSE means denied)

       

      Filtering for only Security=TRUE, everything is good.

       

      However, say I want Bookings summed by Manager so I remove GEO. This breaks the security and the view. I know this is because my security calculation is no longer "True", and is now null as my attr(*) functions across the blend aren't working. I am at a loss for how to resolve. Hiding the label isn't a viable solution.

       

      Is there a way to refactor my formula or some other Tableau feature so that it isn't reliant on the security fields being part of the view?

       

      Big thanks for reading!