This article describes the best way to control access to apps for end users.
For end users of PhixFlow, it is best to control their access to their apps by:
- Giving users the App User role - that means that they have no access to the lists of dashboards, views, streams or any other modelling components in the left-hand menu bar
- Giving them a "landing page" - that is, setting a default dashboard for their user
- All navigation from that point being only by pressing actions buttons on dashboards.
This means that for each type of user you must consider all the dashboards that they need to be able to see, and consider the routes that that allow them to get to these dashboards from their landing page by pressing action buttons.
With this in place, access to apps can be controlled as follows:
- Build up a series of user groups that represent roles – only associate the privileges specifically for this role, not for this role and everything “underneath” it
- Layer the user groups onto the users so that they end up with the access they need
- At least one user group must contain the role App User
- Leave access open to:
- dashboards: Public ticked; All Users Can View Data ticked
- streams: All Users Can View Data ticked
- views: All Users Can View Data ticked
This means that each user group has only at most a single dashboard (it could be more, but in general it won’t be); and a number of actions associated with it. Under this scheme you don’t need to worry about the “Allow All users to View Data” setting on streams.
- No dashboard access is required
- Role (App User) is required in one of the user groups
On dashboards and streams leave “Allow …” ticked, and make dashboards public
See article on setting up App User
This works because with this role users can browse to other dashboards; it might not be the strongest security model in the world, but it a good compromise and it’s really about helping users find their way through the application by not giving them too many options