Type 2: Tag-based authorization

Scenarios

This method uses a user-level permission strategy to personalize data access. For example, users responsible for different regions can view only the data for their assigned regions.

Precautions

This topic applies only to users who purchased or started a trial of Quick BI on or after June 3, 2021. If you do not meet this requirement, you must first upgrade from the legacy row-level permissions to the new version before you proceed.

Limits

• You can configure row-level permissions only in Advanced Edition and Quick BI Enterprise Standard.

• Only dataset owners and workspace administrators can configure row-level permissions.

  Note

  A workspace developer can configure row-level permissions only for the datasets they create, while a workspace administrator can configure them for all datasets.

Procedure

Log on to the Quick BI console. You can configure row-level permissions for a dataset from the workbench or the dataset editing page.

Entry points

Entry point 1

Configure row-level permissions for a dataset from the workbench.

1. Follow the steps in the figure to go to the Row-level Permissions settings page.

   

2. Turn on Enable Row-level Permissions.

   

3. On the Row-level Permissions configuration page, select User Tag-based Authorization and configure association conditions.

   

4. Click Save.

Entry point 2

Configure row-level permissions for a dataset from the dataset editing page.

1. In the top toolbar, click Advanced Configurations and select Permission Control > Row-level Permissions.

2. Turn on Enable Row-level Permissions.

3. On the Row-level Permissions configuration page, select User Tag-based Authorization and configure association conditions.

4. Click Save.

Entry point 3

Configure row-level permissions while you create a dataset.

1. On the dataset preview page, click the icon to go to the Row-level Permissions configuration page.

   

2. Turn on Enable Row-level Permissions.

3. On the Row-level Permissions configuration page, select User Tag-based Authorization and configure association conditions.

4. Click Save.

Configure association conditions

1. Click Add Controlled Field.

2. Select a controlled field and a user tag table field.

3. When adding multiple association conditions, select either AND or OR logic. AND requires all rules to be met, while OR requires only one rule to be met.

4. If the user tag table contains multiple tag rows for the same user, you can choose to merge rows for calculation or calculate rows separately.

   1. Merge rows for calculation: Values from all tag rows are unioned and merged into a single row to verify permissions.

      For example, the following is a user tag table:

      User	Region	Province	City
      user1	Northeast	$ALL_VALUES$	$ALL_VALUES$
      user1	Southeast	Zhejiang	Hangzhou

      With AND logic between conditions, the merged calculation logic is:

      WHERE Region IN ('Northeast', 'Southeast') 
      AND 1=1 -- The Province condition is effectively ignored because $ALL_VALUES$ is a union with a specific value.
      AND 1=1 -- The City condition is effectively ignored because $ALL_VALUES$ is a union with a specific value.

      The effective permissions are equivalent to the following single-row tag:

      User	Region	Province	City
      user1	Northeast,Southeast	$ALL_VALUES$	$ALL_VALUES$

   2. Calculate rows separately: The final permission is the logical OR of each row's permissions. You can use the calculate rows separately mode only when all user tag table fields are from the same user tag table. For example:

      • If the logic between conditions is AND, and the user tag table is as follows:

        User	Region	Province	City
        user1	Northeast	$ALL_VALUES$	$ALL_VALUES$
        user1	North China,Southwest	$ALL_MEMBERS$	$ALL_MEMBERS$
        user1	Southeast	Zhejiang	Hangzhou

        The logic for calculating rows separately is as follows:

        WHERE (Region = 'Northeast') -- Province and City conditions are ignored due to $ALL_VALUES$.
        OR (Region IN ('North China', 'Southwest')) -- $ALL_MEMBERS$ grants access to all provinces and cities within the specified regions.
        OR (Region = 'Southeast' AND Province = 'Zhejiang' AND City = 'Hangzhou')

      • If the logic between conditions is OR, and the user tag table is as follows:

        User	Region	Product Type
        user1	Northeast	$ALL_VALUES$
        user1	North China,Southwest	$ALL_MEMBERS$
        user1	Southeast	Furniture

        The logic for calculating rows separately is as follows:

        WHERE (Region = 'Northeast' OR 1=1) -- The Product Type condition becomes true due to $ALL_VALUES$.
        OR (Region IN ('North China', 'Southwest') OR 1=1) -- The Product Type condition becomes true due to $ALL_MEMBERS$.
        OR (Region = 'Southeast' OR Product Type = 'Furniture')

        The effective permissions are equivalent to the following single-row tag:

        User	Region	Product Type
        user1	Northeast,North China,Southwest,Southeast	$ALL_VALUES$

5. Click Save.

Configure a whitelist

If you want to exempt specific users from the preceding rules, you can add them to the whitelist.

Copy row-level permissions

You can copy row-level permissions from another dataset. For more information, see Copy row-level permissions.

Application scenarios

Scenario 1: Bind a user tag table

1. Create a custom user tag table.

   Binding a user tag table from your data source ensures that Quick BI always reads the latest tag information, eliminating manual maintenance.

   When you create a custom tag table, make sure that it meets the following requirements:

   • It must contain at least one of the following fields: Alibaba Cloud account ID (account_id), Alibaba Cloud account name (account_name), or nickname in the Quick BI organization (nick_name).

     Note

     If you use an Alibaba Cloud account ID or account name, make sure that the corresponding user already exists in your Quick BI organization.

   • It must contain at least one tag field, such as area.

   • If a user has multiple values for a single tag, you can separate the values with a comma (,) in a single row or list them in multiple rows.

   • The value $ALL_MEMBERS$ grants permissions on all data for that field.

   

2. Bind the user tag table.

   After you bind the table, one of its fields, such as the Alibaba Cloud account ID, Alibaba Cloud account name, or nickname, is used as a primary key to associate users with members of your Quick BI organization.

   1. Log on to the Quick BI console.

   2. On the Quick BI homepage, follow the steps in the figure to go to the tag table binding page.

      

   3. Enter a custom name for the user tag table that you want to bind.

      In this example, the user tag table is named Demo Tag Table.

   4. Follow the steps in the figure to configure the user tag table binding.

      

      A preview of the user tag table is shown in the following figure.

3. Add a user tag.

   Once associated, Quick BI passes the values from the user tag table to the corresponding user tags.

   1. Click the User Tag Management tab and then click Add User Tag.

   2. Enter a Tag Name and select an Associated Tag Table Field. Then, save the configuration.

      For the association, select Demo Tag Table. Create custom tag names, such as dy_area, dy_province, dy_city, and dy_order_number. Then, bind them to the area, province, city, and order_number fields in the Demo Tag Table.

4. Use tag-based authorization.

   After you grant permissions, these tag values apply to all relevant datasets, ensuring that users can view only data within their permitted scope.

   1. On the Quick BI homepage, follow the steps in the figure to go to the row-level permissions settings page.

      

   2. Turn on the Enable Row-level Permissions switch and select User Tag-based Authorization for the Authorization Method.

      

   3. In the Configure Association Conditions section, click Add Controlled Field.

   4. Select a controlled field and bind it to a user tag table field.

      The controlled fields and user tag table fields selected in this example are shown in the following figure.

   5. Click Save.

   6. Add users to the whitelist.

      If you want to exempt specific users from the preceding rules, you can add them to the whitelist.

5. Verify the results on a dashboard.

   1. On the dashboard editing page, create a chart and verify the authorization results.

      For example, if you create a cross table, you can see the data for Hangzhou where the order count is 50.

   2. View the data retrieval logic in the SQL query.

      

Scenario 2: Manually manage tags

1. Log on to the Quick BI console.

2. Configure user tags.

   The user tags that you add are used to control the scope of data visibility when you configure row-level permissions.

   1. Follow the steps in the figure to add a user tag.

      

   2. Enter a Tag Name and select an Associated Tag Table Field. Then, save the configuration.

      

      Create custom tag names, such as area, province, city, and order_number. For the Associated Tag Table Field, select manual entry for all tags.

      

3. Manually manage the user tag table.

   In the manual tag management table, select one or more users and assign values to their tags.

   1. On the Tag Management page, click Manual Management in the left-side navigation pane.

   2. Search for a target user and assign values to the user tags.

      The tag assignments in this example are shown in the following figure.

      

4. Use tag-based authorization.

   After you grant permissions, these tag values apply to all relevant datasets, ensuring that users can view only data within their permitted scope.

   1. On the Quick BI homepage, follow the steps in the figure to go to the row-level permissions settings page.

      

   2. Turn on the Enable Row-level Permissions switch and select User Tag-based Authorization for the Authorization Method.

      

   3. In the Configure Association Conditions section, click Add Controlled Field.

   4. Select a controlled field and bind it to a user tag table field.

      The controlled fields and user tag table fields selected in this example are shown in the following figure.

   5. Click Save.

   6. Add users to the whitelist.

      If you want to exempt specific users from the preceding rules, you can add them to the whitelist.

5. Verify the results on a dashboard.

   1. On the dashboard editing page, create a chart and verify the authorization results.

      For example, if you create a cross table, you can see the data for Hangzhou where the order count is 50.

   2. View the data retrieval logic in the SQL query.