Intelligent Data Insight
Intelligent Data Insight
- Documentation
Intelligent Data InsightBest PracticeBest Practices for Management and MaintenanceA Complete Guide to the System Permission Framework
Copy page
Download PDFCopy pageDownload PDF"Why did I apply for project permissions but still cannot view the dashboard?"
"Why did I apply for dashboard permissions but still get a message saying I do not have permission?"
Every day in the backend of the DataWind product help center, "permission" remains one of the most frequently searched keywords.
Today, let's talk about what the various permissions in the product are all about.
First, what are permissions?
Next, what does the product's permission framework look like?
Product permissions are divided into project permissions, data resource (dataset, dashboard) permissions, and data permissions, which respectively determine whether you can access a project, open a dashboard or dataset, and view specific parts of the data.
Project permissions and data resource permissions are further divided into view, edit, and manage permissions. When granting permissions, you can authorize either users or created user groups.
User and user group management, as well as permission changes, can all be performed in the project center.
PS: Role management will be supported in the future
The product's permission types are divided into resource permissions and data permissions.
- Resource permissions include project permissions, dashboard permissions, and dataset permissions.
- Project permissions determine whether you can open a project.
- Dashboard permissions and dataset permissions determine whether you can view the corresponding dashboard or dataset.
- When dashboard or dataset permissions are granted, project view permissions will be automatically enabled.
2.1 Resource permissions
Resource permissions
Permission categories | Viewing permission | Editing permission | Global viewing permission | Management permissions |
|---|---|---|---|---|
Application scenarios | This permission is generally granted to users who view resources. | This permission is generally granted to users who collaborate in editing resources. | This permission is generally granted to the business leader associated with the project who does not participate in permission approval. | This permission is generally granted to the creator of the resource or to users assigned as collaborative managers. |
Project | This means having access to the project, viewing authorized resources within the project, and creating personal dashboards or folders. | In addition to project viewing permissions, users can also create new public dashboards, datasets, or folders in the root of the public directory. | Users have viewing permissions for all public dashboards, public dashboard folders, and datasets within the project, and can view all data. | This means having management permissions for resources within the project, including permission management, project deletion, and other operations. This is the highest permission level for the resource. |
Dashboard | Users can view dashboards, add to favorites, subscribe to regular updates, download charts, and perform other operations. | In addition to having dashboard viewing permissions, users can also edit dashboards and perform other operations. | / | In addition to having dashboard editing permissions, users can also manage permissions, delete dashboards, move them, copy them, and perform other operations. This is the highest permission level for the resource. |
Dataset | On the visual query page, users can query datasets, add temporary fields, download, configure monitoring, and view dataset details. | In addition to having dataset viewing permissions, users can also modify the dataset model, configure scheduled tasks, manage aliases, and perform other operations. | / | In addition to having dataset editing permissions, users can also manage permissions, delete resources, and perform other operations. This is the highest permission level for the resource. |
2.2 Data permissions
Data permissions determine whether you can view the data in charts or dashboards created using a dataset.
Data permissions
Permission categories | Permission definition |
|---|---|
Row-level permission | This means restricting a user to viewing only certain rows of data where a specific field meets a condition. For example, User A can only view data in the dataset where the "Region" field equals Shanghai. |
Column permissions | This means controlling a user so that they cannot see a specific column in the dataset, such as user A not being able to view the "Revenue" column data in the dataset. |
If data permission control, such as row-level permissions, is set for a dataset, then all places using data from that dataset, such as visual queries, charts, dashboards, and so on, will be subject to data permission control, and the control will remain consistent.
3.1 When accessing the dashboard, a message indicates insufficient permissions
Reason: The user does not have permission to view the dashboard (even if the user has data permissions for the corresponding dataset, this does not work).
3.2 Able to view the dashboard, but a specific chart indicates no data permission
Reason: A chart in the dashboard references a dataset with row-level permission control enabled. Since the user has not been authorized, it shows no data permission.
Similar issues include:
Data permissions for the dataset have been requested, but when performing a visualization query, a message indicates no data permission.
3.3 Able to view the dashboard, but when clicking a chart to enter the visualization query, a message indicates insufficient permissions
Reason: Having dashboard permissions allows the user to view the dashboard and its data, but without view permissions for the dataset referenced by the chart, the user cannot use the dataset for visualization queries.
3.4 Able to use the dataset for visualization queries, but a message indicates no data permission
Reason: Having view permissions for the dataset allows the user to access the visualization query page, but without row-level data permissions for the dataset, no data can be viewed.
4.1 Row-level permission configuration
(1) Go to the data permission page and click the plus icon to add a new data permission rule.
(2) Edit the name of the data permission rule for easier identification.
(3) In the rule type, select "Row restriction" to enable row-level permission control.
(4) Select the dataset for which to configure row-level permission control (such as datasets, projects, charts, dashboards, and so on. Users can only configure data permissions for datasets over which they have management permissions).
(5) Configuration methods: Currently, two methods are supported—"Fixed value" and "Dynamic value".
- Fixed value: Select the row-level permission field in the dataset to be controlled and set a fixed value (for example, the "Project Name" field is set to "DataWind"). This is suitable for scenarios where there are few controlled users or where quick authorization can be achieved through simple user group operations.
- Dynamic value: Select the row-level permission field of the dataset to be controlled (such as project name), and set it to read the value of a specific attribute field from the user's attributes (for example, "DataWind project", which can be added in Project Center - User Attributes). When a user affected by this rule accesses the dataset, the value in their "DataWind project" user attribute field (such as DataWind) will be used. This is suitable for scenarios where there are many controlled users and it is not convenient to manage them through user groups.
(6) Permission rules: This refers to the specific configuration of permission rules.
- Permission rules can support multiple conditions. The logical relationship between multiple conditions can be "and" or "or", meaning either all of the following relationships must be met, or any one of the following relationships must be met.
- If the setting method is a fixed value, the logical relationship of the field supports two methods: "belongs to" and "does not belong to".
- Controlled field assignment input box: The dropdown list of options in the controlled field assignment selection box randomly displays only 500 values. Values not in the list can be assigned by manual input. Multiple values can be assigned.
(7) Assign the configured data permission rules to the users or user groups to be affected.
(8) Click the "Save" button in the upper right corner to save and activate the data permission rule, and return to the data permission rule list page.
4.2 Allowlist and blocklist mechanism settings
Currently, for users of the dataset who have not been assigned row-level permissions, the system provides two strategies: "Cannot view any data" and "Can view all data".
The default strategy is: users without row-level permissions cannot view any data.
The user can move the mouse over the dataset name, and a strategy icon will appear on the right. Hovering over the icon displays the current strategy content, and clicking allows switching between strategies.
