This article introduces the core functions of the "System Settings" module in system management in detail, including security settings, copy and download permissions, network area access control, menu access permissions, third-party service authorization, and configuration methods and application scenarios of push notification channels.

In system administration, a system settings module is provided. This module supports the project administrator to set the system security settings (watermark settings, system control), copy and download permission settings, network area access control, menu access permissions, third-party service authorization and push notification channel settings.
Through the watermark setting, users will leave a personal information watermark in the picture when taking a screenshot;
Through system control, system admin can configure the account to log in to this product to automatically join or manually manage, and authorize members outside the project;
By setting the copy and download permission, users will not be able to copy and download data in large quantities or directly copy and download data, limiting their ability to move data to other platforms.
By setting up network area access, users can only use the system in network environments such as intranets.
By setting menu access permissions, administrators can set menu entries that users can see.
Through third-party service authorization, administrators can ensure compliance and control of external service usage.
By setting up a push notification channel, the consumer can receive messages about the desired item through the specified channel.

Security settings #

Watermark settings #

Support the configuration of PC and mobile end watermarks. The administrator can set the watermark on the computer and mobile end, and supports adjusting the watermark content(username, last 4 digits of mobile phone number, IP, current time), watermark style(single row, line break), watermark color and watermark font size.

System control #

In system control, the administrator can set the license control method and the resource administrator can only authorize users under this project.

• License control method:
  • "System users log in to this product will automatically join": After system users log in to this product, they will automatically join the license list, without the need for administrators to configure the list again. It is suitable for situations where the number of accounts and resources are not tight and resources can be shared, which is more convenient;
  • "System admin configure license list": Resource administrators are required to manually configure the license list, and system users who are not on the list cannot access resources after logging in. It can control license occupancy to avoid the problem of "first come, first served"; It can control DataWind users to meet resource isolation requirements.
• The resource administrator can only authorize users under this project: if enabled, the resource administrator can only authorize users under this project; if disabled, all users can be authorized.

Copy and download #

Support configuring system global copy and download permissions. When the "Allows data to be downloaded/copied" button is turned off, all projects in the system will not support downloading/copying data, which can effectively reduce the chance of data being propagated; administrators can also limit the maximum number of downloadable lines at a time, limiting the behavior of users downloading data in batches.

Network Area Access Control #

Basic introduction #

In industries and enterprises with strict data security controls, there are usually multiple sets of network environments, such as production networks (intranets), office networks, and the Internet. In different network environments, there are different degrees of control over the openness of data and the operation of production data. This function is suitable for use in different scenarios.
Scenario 1: The production environment supports viewing the original data source and supporting the production of the data.
Scenario 2: The office network environment supports viewing data, but the data needs to be desensitized, and does not support data development(data set creation, etc.) actions.
Scenario 3: The Internet environment(mobile end) only supports the opening of some data assets, which can be accessed on the mobile end.

The above scenarios can be achieved through network area access control + data desensitization capability.

Scene example #

Restrict access to the network

For scenarios where the system is only used on the office network or part of the network, the specific operations are as follows:

1. Open "Multi-Network Zone" in System Administration - Security Settings - Network Zone Access Control and add a new network zone.
   
2. Fill in the name, domain name, ID and other basic information, set the accessible terminal, accessible module, push method, data desensitization application scope, and click Save.
   
   Multiple network zones can be added to differentiate access control settings for different networks.
3. In addition to the multi-network zone, you can also perform global configuration on the right to set the default access network.
   

Link encrypted to short URL
For the scenario of encrypting the embedded link into a short URL, the specific operations are as follows:

1. System admin needs to check "Encryption Embedded" in System Administration - Security Settings - Network Area Access Control.
   
2. The project administrator needs to check "Include encrypted embedding" in the column of Embedding project resources in the project center - project information.
   
3. When users in the project embed charts or dashboards, they can encrypt the embedded links.

Menu access #

By setting the user's menu access, you can control the use of functions based on roles, effective for all projects. Among them, V2.91.0 and above versions of "Data Preparation" support secondary menu configuration. Roles that previously had data preparation permissions have three secondary menu permissions (dataset, data modeling, data connection) by default after the new function is launched; with any one or two-level menu permissions, you can see the data preparation menu.

Third-party service authorization #

The third-party service authorization function is used to configure the external services that the project can access, clarify the linkage authority between the project and the third-party tools, and ensure the compliance and control of the use of external services. Contains information such as project name, available third-party services, default third-party authorization, and default third-party authorization services.

Map configuration #

Map configuration is used to manage map resources used by visualized queries.
Two tabs are available under System Administration > System Settings > Map Configuration:

Prerequisite #

• You need to use an account with system setting permissions to operate;
• When adding JSON resources, ensure that the JSON URL is accessible.
• Before using the GIS layer, make sure that the network can connect to the configured map service and that the AK is correct.
• After the map configuration is completed, you can select the corresponding map in the visualized query for verification.

Custom JSON resources #

In the "Custom JSON Resources" tab, you can view the added map resources, and the map can be selected in the populated map and tagged map of the visualized query.

• Add map: Click the Add Map button at the top right of the custom JSON resource list, and **** fill in the map information in the pop-up window:

Custom GIS Layer #

On the Custom GIS Layers page, enable Custom GIS Layers to use LBS series maps in visualized queries.

Push notification channel #

The push notification channel supports binding different enterprise WeChat and enterprise mailboxes to different projects. After the binding is successful, the project will use the corresponding WeCom or enterprise mailbox for push notification by default.
Users need to access "Email" or "WeCom" in "System Configuration" - "Office Platform" before the "Push Notification Channel" page will appear in the "System Administration" - "System Settings" page.