Customer Properties In Security Rule Does Not Allow Users To See Task Triggers

Customer Properties In Security Rule Does Not Allow Users To See Task Triggers

Steps to reproduce the issue:

1.Assign the customer properties to User and Apps, then assign the user access towards apps. 
2.Create reload tasks for apps. 
3.Create trigger for the tasks.  So on the tasks, the task chains show the preceding tasks. 
4.Use the customer properties as the condition for SchemaEvents_* and CompositeEvents_* to allow the user to see the triggers if the user has access to the apps.  For instance, the condition is "resource.app.@department=user@department "
5. The user only can see the reload tasks but not the preceding tasks. 

Environment:

• Qlik Sense Enterprise on Windows, all versions

This is working as per design.  The reason is Custom Properties cannot be applied to triggers (SchemaEvent_, CompositeEvent_)

Therefore the condition resource.app.@department=user@department will not give access to triggers. Only to Tasks.
 

Examples:

1. Works OK when direct access is given:

 

Resource filter: ReloadTask_*,SchemaEvent_*,CompositeEvent_* Action: Read Conditions: ((user.userId="rd-adam"))

 

2. Does NOT work when access is given via custom properties:

 

Resource filter: ReloadTask_*,SchemaEvent_*,CompositeEvent_* Action: Read Conditions: ((resource.app.@test=user.@test))

 

OR

 

Resource filter: App_* Action: Read Conditions: ((user.@test=resource.@test)) AND Resource filter: ReloadTask_*,SchemaEvent_*,CompositeEvent_* Action: Read Conditions: ((resource.app.HasPrivilege("Read")))

 

  ! The information in this article is provided as-is and to be used at own discretion. Depending on tool(s) used, customization(s), and/or other factors ongoing support on the solution below may not be provided by Qlik Support.

This behavior is considered to be working as designed.

The only way of achieving is by providing direct access to either directly to the User or Group resource and not by using custom properties.

For example, while assigning directly to a User, the condition is " ((user.userId="rd-adam")) "