One important feature used in Tableau Server are the permissions that can be set to a project, workbook or data source for specific users and user groups. Uploading sensitive content to Tableau Server without setting permissions for the users could lead to complications. This blog describes how the hierarchy works for the permissions and how to implement and edit the permissions for a project.
- Permissions Hierarchy
It is important to note how the hierarchy works with setting the permissions in the project, workbooks and data source and the level to which the permissions are set. The hierarchy is best depicted with the flow diagram below:
In summary:
- If a capability is not allocated to a user, they are denied access.
- If the user is an admin or project leader, they are permitted access on all content.
- If a user is permitted access to a certain action but within the user group they are denied access to this action, the individual permissions take precedent over the group permissions.
- Similarly, if a user is denied access to a certain action but within the user group they are permitted access to this action, the individual will not be permitted access to this action.
2. How to Implement Permissions
Permissions are implemented for a project by selecting the permissions option from the ellipses next to the project name. I use our DS29 project file as the example here:
The permissions dialogue window will appear as follows:
This window shows the default permissions set for 'All Users' and additional users that have been allocated access to the project. The permissions are the rules that you set to allow certain users or groups of users to access certain content.
To add permissions to a project, select the outlined block '+ Add Group/User Rule' and subsequently select the user group you want to allow access to. Within this option, you can select the specific permissions to be allocated to the user or user group for the project, workbooks and data sources. These options are displayed above the 'Group/User' heading.
Once the user or group has been selected, the permissions can be allocated by two alternatives:
- Individual capabilities
- Select the drop down option. This will allocate default properties and rules based on the specific role chosen. Alternatively, custom configurations can be selected for the role in addition to the default permissions allocated.
There are three options when allocating a capability to the user or group:
- Green tick: permits the user/group access to the action
- Red cross: denies the user/group access to the action
- Blank: unspecified access to the action
