Is it possible to (programmatically or via UI) assign custom roles to BigQuery Datasets? We would like to have access controls at a more granular level within a project, but I cannot find any indication that these are supported, or that they are not supported. The "share dataset" UI n BigQuery does not offer an obvious way to specify which roles have access.
This is the best I could do so far, but it throws an error about the entity_id
for dataset in datasets:
dataset_ref = bigquery.Dataset(dataset, frankie_client)
entry = bigquery.AccessGrant(
role='projects/xxxxxx/roles/custom_role1',
entity_type='specialGroup',
entity_id='projects/xxxxxx/roles/custom_role1')
assert entry not in dataset_ref.access_grants
entries = list(dataset_ref.access_grants)
entries.append(entry)
dataset_ref.access_grants = entries
dataset = dataset_ref.update() # API request
assert entry in dataset.access_entries
By the way, google's API is incredibly unstable and poorly documented.... If anyone knows how to do this, would be much appreciated.
*UPDATE AT THE END.
There is a long documentation page describing all the roles and discusses custom roles as well.
https://cloud.google.com/bigquery/docs/access-control
I think what you missed is that you need to apply a group on a dataset. And if you setup the group correctly you can do a lot of flexible things.
Check out the examples scenarios section in the linked page. That has your use case explained.
Read and write access to data in a dataset
CompanyProject is a project that includes dataset1 and dataset2. AnalystGroup1 is a group of data scientists who work only on dataset1 and AnalystGroup2 is a group that works only on dataset2. The data scientists should have access only to the dataset that they work on and should not be able to run queries.
Full access to a dataset
On dataset CompanyProject:dataset1 Add AnalystGroup1 to the predefined role bigquery.dataOwner.
On dataset CompanyProject:dataset2 Add AnalystGroup2 to the predefined role bigquery.dataOwner.
In addition to the pre-defined roles, BigQuery also supports custom roles. For more information, see Creating and Managing Custom Roles in the Cloud IAM documentation.
To add more, in the IAM page, you are able to see much easier the roles an assigned user has. And the custom role you created is grouped under the Custom label.
Update
The documentation has been improved after my issue ticket.
Note: Currently, you cannot apply a custom role to a dataset. For more
information on dataset access controls, see Assigning access controls
to datasets.
Related
My team and I are handling hundreds of subscriptions that are belonging to different teams.
Many of them have different needs in terms of security, services to be used, etc whereas we, as a central platform, also make sure that everyone work with the same baseline (security, monitoring, automation, etc.).
We of course have a need to handle RBAC and we are using custom roles a lot. I was wondering if there was a way to create a custom role based on another one to benefit from "classic inheritance".
So I could create for example a role named "basic_user" that would contains a set of "Actions" and an "advanced_user" could have "basic_user" accesses plus additional ones, and so on with "super_advanced_user".
I know that Microsoft has designed it the opposite way so far, allowing us to assign multiple roles to a given individual/group, but for internal design reasons, we would like to stick to one role assignment for a given recipient (one AAD group containing all people accordingly to their role).
Is this something technically feasible/reproducible or does anyone heard about such a feature ? Or maybe is it something we should not consider because of some reasons you'd want to highlight ?
The feature that you would like to implement as you described is not currently not available as you were already aware of this. But however you can post about this feature directly via this link. It will reviewed directly by the Microsoft engineering teams and will respond.
Currently I have the following scenario. I have a report in Power BI which reads from a dataset which has data of all companies. In my ASP .NET MVC application the user will select the company for which to display the report and with Power BI Embedded the application filters the report by the ID of the company through the embed config defined in JS (filter parameters passed from server).
I am using app owns data approach where I have a master account and the embed token is generated for the master account.
The user accessing the report does not have access rights to all companies and this is being handled server-side. With this approach however, the user can easily alter the embed config in JS and display the report for a company which he is not authorized to access.
I looked into row-level security and I found the following approach https://community.powerbi.com/t5/Developer/PowerBi-Embedded-API-Works-with-RLS/td-p/231064 where there exists a role for every company and the embed token is generated for that particular company. This would be an ideal approach but in my scenario the companies are not pre-defined and can be created any time. Therefore, I would need to create a role per company. This however cannot be achieved programmatically as Power BI does not provide means to automate role creation.
The only approach I can think of is to clone a report for each new company and create a dataset specific to that report which will only have the data for that particular company. Then the generated embed token will only be valid for that particular report.
Has anyone also experienced this dilemma? Any suggestions what I should do in such scenario?
You still can use RLS, but without roles per company. Use USERPRINCIPALNAME() DAX function to find out which user is viewing the report. In the database make a table to specify which company can be seen by which user and add it to your model. Then use RLS to filter this table to only the row (or rows) where user is current one (here is where USERPRINCIPALNAME() comes into play), and let the relationship between this table and your data tables to filter out what should not be seen. This way there will be no JavaScript filters at all, so nothing can be changed by some malicious user.
See Using the username() or userprincipalname() DAX function.
I have a customer that owns a carpet cleaning business and we have all of his different franchisee's data in a multi-tenant database model and we would like to move this data into a data warehouse in snowflake. I don't want to have to build a separate database for each customer because then I have to keep each database up to date with the latest data model. I want to use 1 data model to rule them all. I have a tenant ID that I keep with each record to identify the franchisee's data. I want to give a set of credentials to each franchisee to where they can hook up their analytics tool of choice (tableau, power bi, etc.) and only get access to the rows that are applicable to them. Is there a way to secure the rows they see in each table based on their user. In other words some sort of row level access control similar to profiles in postgres. Are there any better methods for handling this type of scenario? Ultimately I want to maintain and manage the least number of elt jobs and data models.
This is the purpose of ether Secure Views, or Reader Accounts.
We are using both, and they have about the same technical hassle/setup costs. But we are using an internal tool to build/alter the schema's.
To expand on Simeon's answer:
You could have a single Snowflake account and create a Snowflake role & user for each franchisee. These roles would have access to a Secure View which uses the CURRENT_ROLE / CURRENT_USER context functions as in this example from the Snowflake documentation.
You'd have to have a role -> tennant ID "mapping table" which is used in the Secure View to limit the rows down to the correct franchisee.
I have created a PowerView using a BISM connection in Enterprise Portal of AX. That PowerView report will be used by 100+ users. I want every user to his/her data in the PowerView instead of viewing the complete data. One option is to create 100+ security roles in SSAS (multidimentional) which is not a viable option. Please guide me how can i achieve dynamic security in PowerView so that every user sees its own view. Thanks.
Power View doesn't not offer any kind of security. You will need to do this in SSAS, but you don't need 100+ security roles. You will want to look into dynamic security. To create dynamic security, you will need some way to relate a user to the information they should see. This usually means adding a field to an existing table or creating new tables.
If all users are secured by the same attributes, they can be contained in a single role. If some users are secured based on one attribute and others based upon another attribute, then you may need multiple roles.
Here's how this might work.
Create a table that contains all users that will need access to your cube.
Create a bridge table that ties the users to the attribute on which you are securing their access. For instance, maybe users can only see certain products so you have a table of User IDs and Product IDs.
Add these tables to your DSV.
Create a user dimension.
Create a measure group based upon your security bridge table
Create a role for this user type and add an MDX statement to the Allowed Member Set. Also, set the Enable visual totals checkbox.
Populate the members for the role, preferably through an AD group rather than individually if you have 100+ users.
Your allowed member set will look something like
Exists(
{[Product].[Product ID].members},
STRTOSET("[Users].[UserName].[UserName].&[" + Username() + "]"),
"Bridge User Product"
)
You can find a good blog post here and a good video about SSAS security here (dynamic security starts around the 35 minute mark).
We are using LDAP based authentication with geoserver which is connected to a PostGIS database.
Users insert rows (features) into the table (layer) using WFS-T after authentication.
Now when users query for data from this layer (also after authentication), we would like to return data that is applicable to this user based on their credential (i.e) only view data that was inserted by that user or group.
We are storing the username in the table. We get the username because this is defined as non-null column in our table and users are required to provide it as a part of their WFS-T insert.
I read about service level security and layer level security, but what we need seems more like row level or feature level security.
We can use JDBC based authentication instead of LDAP if needed, but do not know if this will solve the problem.
I am pretty comfortable with Java and some what knowledgeable on spring security and hence can deal with customizations if needed. Please advice.
You need to use either of role-based access control (rbac) or attribute-based access control (abac). Spring Security will provide you with the former. You'll need XACML for the latter.
Once you know the identity of the user you can determine what role and group they belong to. In XACML you can define a policy which dictates how access is granted. Use XACML if there are relationships between the data you're protecting and the users accessing it.
You'll need a web service filter to intercept the request and/or the response. That filter is called a policy enforcement point in the XACML architecture.
If you have large amounts of data then you want to use something like the Axiomatics data access filter which uses XACML policies to create a SQL WHERE clause used to retrieve entitled data only.
Hth