Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
35 commits
Select commit Hold shift + click to select a range
02fee62
Rename modules/ROOT/pages/custom-actions-callback.adoc to modules/ROO…
bryanthowell-ts Nov 13, 2024
ff3e711
Rename modules/ROOT/pages/custom-actions-edit.adoc to modules/ROOT/pa…
bryanthowell-ts Nov 13, 2024
becea31
Rename modules/ROOT/pages/custom-actions-url.adoc to modules/ROOT/pag…
bryanthowell-ts Nov 13, 2024
6cfdb63
Rename modules/ROOT/pages/custom-actions-viz.adoc to modules/ROOT/pag…
bryanthowell-ts Nov 13, 2024
fb26fdf
Rename modules/ROOT/pages/custom-actions-worksheet.adoc to modules/RO…
bryanthowell-ts Nov 13, 2024
e356e99
Rename modules/ROOT/pages/custom-actions.adoc to modules/ROOT/pages/c…
bryanthowell-ts Nov 13, 2024
918fcf0
Rename modules/ROOT/pages/git-configuration.adoc to modules/ROOT/page…
bryanthowell-ts Nov 13, 2024
2d4a8dc
Rename modules/ROOT/pages/version_control.adoc to modules/ROOT/pages/…
bryanthowell-ts Nov 13, 2024
26958d9
Rename modules/ROOT/pages/git-rest-api-guide.adoc to modules/ROOT/pag…
bryanthowell-ts Nov 13, 2024
796a79f
Rename modules/ROOT/pages/guid-mapping.adoc to modules/ROOT/pages/ver…
bryanthowell-ts Nov 13, 2024
0056567
Rename modules/ROOT/pages/trusted-authentication.adoc to modules/ROOT…
bryanthowell-ts Nov 13, 2024
7146115
Rename modules/ROOT/pages/trusted-auth-troubleshoot.adoc to modules/R…
bryanthowell-ts Nov 13, 2024
e090d71
Rename modules/ROOT/pages/trusted-auth-token-request-service.adoc to …
bryanthowell-ts Nov 13, 2024
c4b9893
Rename modules/ROOT/pages/trusted-auth-secret-key.adoc to modules/ROO…
bryanthowell-ts Nov 13, 2024
f2b4637
Rename modules/ROOT/pages/trusted-auth-sdk.adoc to modules/ROOT/pages…
bryanthowell-ts Nov 13, 2024
f362b4a
Rename modules/ROOT/pages/configure-saml.adoc to modules/ROOT/pages/a…
bryanthowell-ts Nov 13, 2024
0bb9d56
Rename modules/ROOT/pages/configure-oidc.adoc to modules/ROOT/pages/a…
bryanthowell-ts Nov 13, 2024
ffbd62b
Rename modules/ROOT/pages/abac-user-parameters.adoc to modules/ROOT/p…
bryanthowell-ts Nov 13, 2024
f74d64c
Rename modules/ROOT/pages/rls-rules.adoc to modules/ROOT/pages/author…
bryanthowell-ts Nov 13, 2024
c48c56a
Rename modules/ROOT/pages/access-control-sharing.adoc to modules/ROOT…
bryanthowell-ts Nov 13, 2024
2f684da
Rename modules/ROOT/pages/data-security.adoc to modules/ROOT/pages/au…
bryanthowell-ts Nov 13, 2024
4b19649
Rename modules/ROOT/pages/privileges-and-roles.adoc to modules/ROOT/p…
bryanthowell-ts Nov 13, 2024
c017ce8
Renamed deployment-and-integration and moving files
bryanthowell-ts Nov 13, 2024
b0bed36
Moving rest API V1 and V2 into their folders
bryanthowell-ts Nov 13, 2024
97bb09b
A few more rest API pages
bryanthowell-ts Nov 13, 2024
0862c6f
More files moving
bryanthowell-ts Nov 13, 2024
ca1677f
Update session-api.adoc
bryanthowell-ts Nov 14, 2024
4b40d67
Update session-api.adoc
bryanthowell-ts Nov 14, 2024
2880e14
Update session-api.adoc
bryanthowell-ts Nov 14, 2024
a95fc32
Update runtime-filters.adoc
bryanthowell-ts Nov 14, 2024
ea1853c
Rename modules/ROOT/pages/rest-api-v1/session-api.adoc to modules/ROO…
bryanthowell-ts Nov 14, 2024
39f916f
Update session-api.adoc
bryanthowell-ts Nov 14, 2024
7597cd1
Update session-api.adoc
bryanthowell-ts Nov 14, 2024
c16bc32
move files with includes back to root directory
bryanthowell-ts Nov 14, 2024
2c646d2
Replaced all improper target= properties with correct window= property
bryanthowell-ts Nov 14, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -113,4 +113,5 @@ docs/public/
modules/**/generated/

# PyCharm
.idea
.idea
dev_docs.code-workspace
2 changes: 1 addition & 1 deletion gatsby-config.js
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,7 @@ class CustomDocConverter {
}
anchorMarkup = `href="${anchorMarkup}"`;
if (attributes.window) {
anchorMarkup += ` target="${attributes.window}"`;
anchorMarkup += ` window="${attributes.window}"`;
}
return `<a ${anchorMarkup}>${node.getText()}</a>`;
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -85,7 +85,7 @@ When used as a bearer token, the lifespan of the token is established when it is
The `init()` function can automatically request a new token when it detects either the session or the token has expired if the `autoLogin: true` option is set. You may also set `disableLoginRedirect: true` to customize the behavior when `autoLogin` is in place. See the xref:getting-started.adoc#_configure_security_and_login_parameters_optional[init() function documentation] for a full description of the available customizations.

=== REST API requests
The Visual Embed SDK provides a link:https://developers.thoughtspot.com/docs/Function_tokenizedFetch[tokenizedFetch, target=_blank] function to use in place of the standard browser `fetch()` function, which will provide the current bearer token when using cookieless trusted authentication.
The Visual Embed SDK provides a link:https://developers.thoughtspot.com/docs/Function_tokenizedFetch[tokenizedFetch, window=_blank] function to use in place of the standard browser `fetch()` function, which will provide the current bearer token when using cookieless trusted authentication.

Please see the documentation on xref:rest-apiv2-js.adoc[REST API V2.0 within a browser] for further explanation and example code.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ Attribute-Based Access Control (ABAC) is a pattern where security entitlements a
RLS using ABAC via tokens is in BETA. As this feature directly impacts data security in your environment, ThoughtSpot does not support its use in a Production environment until it becomes Generally Available. ThoughtSpot is working on improvements in the upcoming releases that will change some of the best practices recommended in this article and result in the needed re-work of your deployment's security architecture. To understand the RLS best practices for your use case and deployment timelines, and to get these features enabled on your ThoughtSpot instances, contact ThoughtSpot Support.
====

Currently, the ABAC via tokens method requires using *link:https://docs.thoughtspot.com/cloud/latest/worksheet-create[Worksheets, target=_blank]* as data sources for Liveboards and Answers, rather than individual table objects.
Currently, the ABAC via tokens method requires using *link:https://docs.thoughtspot.com/cloud/latest/worksheet-create[Worksheets, window=_blank]* as data sources for Liveboards and Answers, rather than individual table objects.

== Overview

Expand All @@ -38,7 +38,7 @@ For the same reasons, end users of an embedded app cannot have *edit* access to
The request for a token with ABAC details can *xref:abac-user-parameters.adoc#persistForUser[persist]* the set of filters and parameter values to the user's `user_parameters` property, after which all sessions and scheduled reports will use the persisted values.

== Token request
The ABAC message to ThoughtSpot is encoded in JSON Web Token (JWT) format, using the existing ThoughtSpot link:https://developers.thoughtspot.com/docs/restV2-playground?apiResourceId=http%2Fapi-endpoints%2Fauthentication%2Fget-full-access-token[V2.0 REST API Access Tokens, target=_blank], which are OAuth JWT tokens.
The ABAC message to ThoughtSpot is encoded in JSON Web Token (JWT) format, using the existing ThoughtSpot link:https://developers.thoughtspot.com/docs/restV2-playground?apiResourceId=http%2Fapi-endpoints%2Fauthentication%2Fget-full-access-token[V2.0 REST API Access Tokens, window=_blank], which are OAuth JWT tokens.

The token can be used as a bearer token for Cookieless Trusted Auth or REST API access, or as a sign-in token to create a ThoughtSpot session, in which case the ABAC user parameters should be *persisted*.

Expand All @@ -48,7 +48,7 @@ ThoughtSpot compresses the size of JWT token by default to ensure that larger pa
====

=== Request format
The ABAC request is sent using the `user_parameters` key of the link:https://developers.thoughtspot.com/docs/restV2-playground?apiResourceId=http%2Fapi-endpoints%2Fauthentication%2Fget-full-access-token[V2.0 Full Access Token request, target=_blank].
The ABAC request is sent using the `user_parameters` key of the link:https://developers.thoughtspot.com/docs/restV2-playground?apiResourceId=http%2Fapi-endpoints%2Fauthentication%2Fget-full-access-token[V2.0 Full Access Token request, window=_blank].

There are three potential keys within `user_parameters`, each taking an array of objects:
[code,javascript]
Expand All @@ -65,7 +65,7 @@ The format for the objects in each section follows the equivalent formats in the

There is a `xref:abac-user-parameters.adoc#persistForUser[persist]` key to be added on each object that takes a boolean `true` or `false`. This determines if the values are persisted at the user level beyond just the token itself, for features such as alerts and subscriptions that run outside a user's session.

The following is a `user_parameters` section that would be part of the JSON request of the link:https://developers.thoughtspot.com/docs/restV2-playground?apiResourceId=http%2Fapi-endpoints%2Fauthentication%2Fget-full-access-token[V2.0 Full Access Token request, target=_blank]:
The following is a `user_parameters` section that would be part of the JSON request of the link:https://developers.thoughtspot.com/docs/restV2-playground?apiResourceId=http%2Fapi-endpoints%2Fauthentication%2Fget-full-access-token[V2.0 Full Access Token request, window=_blank]:

[source,JavaScript]
----
Expand Down Expand Up @@ -310,15 +310,15 @@ If the parameter is named `Secured` and the *shared secret* value is `rxzricmwfe
=== Use Parameters to filter a Worksheet
The basic pattern for using a Parameter to filter a Worksheet includes these steps:

. Create link:https://docs.thoughtspot.com/cloud/latest/parameters-create[Parameters, target=_blank] in Worksheet
. Make link:https://docs.thoughtspot.com/cloud/latest/formulas[formula, target=_blank] that evaluates the Parameter's default value and the expected values from the token
. Make link:https://docs.thoughtspot.com/cloud/latest/filters#_worksheet_filters[Worksheet filter, target=_blank] based on the formula, set to *true*.
. Create link:https://docs.thoughtspot.com/cloud/latest/parameters-create[Parameters, window=_blank] in Worksheet
. Make link:https://docs.thoughtspot.com/cloud/latest/formulas[formula, window=_blank] that evaluates the Parameter's default value and the expected values from the token
. Make link:https://docs.thoughtspot.com/cloud/latest/filters#_worksheet_filters[Worksheet filter, window=_blank] based on the formula, set to *true*.

link:https://docs.thoughtspot.com/cloud/latest/parameters-create[Parameters, target=_blank] are defined at the Worksheet level within ThoughtSpot. Parameters have a data type and a default value set by the Worksheet author.
link:https://docs.thoughtspot.com/cloud/latest/parameters-create[Parameters, window=_blank] are defined at the Worksheet level within ThoughtSpot. Parameters have a data type and a default value set by the Worksheet author.

To use a Parameter, you'll make a link:https://docs.thoughtspot.com/cloud/latest/formulas[formula, target=_blank] on the Worksheet.
To use a Parameter, you'll make a link:https://docs.thoughtspot.com/cloud/latest/formulas[formula, window=_blank] on the Worksheet.

link:https://docs.thoughtspot.com/cloud/latest/filters#_worksheet_filters[Worksheet filters, target=_blank] can reference Worksheet formulas once they have been created, which creates the security layer out of the result of the formula.
link:https://docs.thoughtspot.com/cloud/latest/filters#_worksheet_filters[Worksheet filters, window=_blank] can reference Worksheet formulas once they have been created, which creates the security layer out of the result of the formula.

All of these Worksheet-level features are set by clicking *Edit* on the Worksheet, then expanding the menu on the left sidebar:

Expand Down Expand Up @@ -371,7 +371,7 @@ Parameters can be used in a formula to directly match a value in a column, or an
`if ( parameter_name = field_name ) then true else false`

===== Use Parameters with pass-through functions
link:https://docs.thoughtspot.com/cloud/latest/formula-reference#passthrough-functions[ThoughtSpot SQL Pass-through functions, target=_blank] allow you to send arbitrary SQL to the data source, while passing in values to substitute from ThoughtSpot.
link:https://docs.thoughtspot.com/cloud/latest/formula-reference#passthrough-functions[ThoughtSpot SQL Pass-through functions, window=_blank] allow you to send arbitrary SQL to the data source, while passing in values to substitute from ThoughtSpot.

The basic form of the SQL Pass-through function is:

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -49,11 +49,11 @@ A user with *administrator* privileges can share any content to any user or grou
image::./images/shareability_can_share_to.png[Shareability and group membership controls visibility]

== Sharing via UI
Within the ThoughtSpot UI, there are buttons or menu items to trigger the sharing workflow for every type of object (link:https://docs.thoughtspot.com/cloud/latest/share-liveboards#share-liveboardpage[Liveboards, target=_blank] or link:https://docs.thoughtspot.com/cloud/latest/share-worksheets[worksheets, target=_blank] for example).
Within the ThoughtSpot UI, there are buttons or menu items to trigger the sharing workflow for every type of object (link:https://docs.thoughtspot.com/cloud/latest/share-liveboards#share-liveboardpage[Liveboards, window=_blank] or link:https://docs.thoughtspot.com/cloud/latest/share-worksheets[worksheets, window=_blank] for example).


== Sharing via REST API
The REST API v2 link:https://developers.thoughtspot.com/docs/restV2-playground?apiResourceId=http%2Fapi-endpoints%2Fsecurity%2Fassign-change-author[/security/metadata/share endpoint, target=_blank] is used to programmatically share content, or to remove any access.
The REST API v2 link:https://developers.thoughtspot.com/docs/restV2-playground?apiResourceId=http%2Fapi-endpoints%2Fsecurity%2Fassign-change-author[/security/metadata/share endpoint, window=_blank] is used to programmatically share content, or to remove any access.

The API request has two components, `metadata_identifiers` and `permissions`:

Expand Down Expand Up @@ -104,17 +104,17 @@ Requests to the `/fetch-permissions` endpoints will never return any user or gro
== Auditing access control
Sharing details are not returned via the responses from the `/metadata/search` endpoints. Instead, there are two REST API endpoints under the */security/* for retrieving access control details.

Using the link:https://developers.thoughtspot.com/docs/restV2-playground?apiResourceId=http%2Fapi-endpoints%2Fsecurity%2Fassign-change-author[/security/metadata/fetch-permissions, target=_blank] endpoint on an object will return the *effective permissions* for all groups and the users within those groups who have access to the object.
Using the link:https://developers.thoughtspot.com/docs/restV2-playground?apiResourceId=http%2Fapi-endpoints%2Fsecurity%2Fassign-change-author[/security/metadata/fetch-permissions, window=_blank] endpoint on an object will return the *effective permissions* for all groups and the users within those groups who have access to the object.

Effective permissions for an object are the full set of groups and users who have access, and what that access level is.

The link:https://developers.thoughtspot.com/docs/restV2-playground?apiResourceId=http%2Fapi-endpoints%2Fsecurity%2Fassign-change-author[/security/principals/fetch-permissions endpoint, target=_blank] is used to get the *effective permissions* for a specific user or group.
The link:https://developers.thoughtspot.com/docs/restV2-playground?apiResourceId=http%2Fapi-endpoints%2Fsecurity%2Fassign-change-author[/security/principals/fetch-permissions endpoint, window=_blank] is used to get the *effective permissions* for a specific user or group.

Effective permissions for a user are based on things shared to them individually and their group membership. Group effective permissions should be close to their __defined permissions__ but hierarchical groups are a feature in ThoughtSpot that would lead to more complex scenarios (hierarchical groups are discouraged when doing embedded ThoughtSpot integrations).


== Re-assign content author
The *author* of any object can be re-assigned using the V2.0 link:https://developers.thoughtspot.com/docs/restV2-playground?apiResourceId=http%2Fapi-endpoints%2Fsecurity%2Fassign-change-author[/security/metadata/assign, target=_blank] REST API endpoint:
The *author* of any object can be re-assigned using the V2.0 link:https://developers.thoughtspot.com/docs/restV2-playground?apiResourceId=http%2Fapi-endpoints%2Fsecurity%2Fassign-change-author[/security/metadata/assign, window=_blank] REST API endpoint:

[source,JSON]
----
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ ThoughtSpot has three mechanisms for row-level security:

* xref:rls-rules.adoc[RLS Rules, window=_blank] applied to the ThoughtSpot table objects
* xref:abac-user-parameters.adoc[Attribute-Based Access Control (ABAC)] filters and parameters passed in via login token
* link:https://docs.thoughtspot.com/cloud/latest/connections-snowflake-oauth[OAuth connections, _target=blank]: Individualized login to the data warehouse connection using OAuth, where security rules have already been implemented for each user.
* link:https://docs.thoughtspot.com/cloud/latest/connections-snowflake-oauth[OAuth connections, _window=blank]: Individualized login to the data warehouse connection using OAuth, where security rules have already been implemented for each user.

The OAuth workflow requires opening a new window or redirecting to the OAuth provider for the initial sign-in workflow, making it less seamless than using a service account and defining data security via ThoughtSpot. It tends to be used for non-embedded ThoughtSpot use cases or for embedded applications for an organization's internal users with existing individual data warehouse user accounts.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ The two basic patterns for RLS Rules are *direct RLS rules* that reference a col
If neither of these patterns is easily implemented, please consider the xref:abac-user-parameters.adoc[ABAC via tokens] method of RLS, available starting in ThoughtSpot 9.11.

== RLS rules overview
*RLS rules* are link:https://docs.thoughtspot.com/cloud/latest/security-rls-implement[defined within ThoughtSpot, target=_blank] on table objects, and automatically extend to all worksheets, saved answers, and Liveboards based on that table, every time.
*RLS rules* are link:https://docs.thoughtspot.com/cloud/latest/security-rls-implement[defined within ThoughtSpot, window=_blank] on table objects, and automatically extend to all worksheets, saved answers, and Liveboards based on that table, every time.

RLS rules are defined using either the *ts_username* variable or *ts_groups* variable. The RLS rules translate into WHERE clauses in any SQL query generated from that table object, with the variables expanding into the details of the signed-in user. *ts_groups* turns into the set of *group name* properties of the ThoughtSpot groups the user belongs to.

Expand Down Expand Up @@ -152,7 +152,7 @@ The ACL table pattern introduces an additional table, the Access Control List (A
|region_4
|===

Within ThoughtSpot, you will establish link:https://docs.thoughtspot.com/cloud/latest/tables-join#_create_a_table_join[INNER JOINs, target=_blank] between each of the columns of the ACL table and the fact or dimension table that needs to be filtered.
Within ThoughtSpot, you will establish link:https://docs.thoughtspot.com/cloud/latest/tables-join#_create_a_table_join[INNER JOINs, window=_blank] between each of the columns of the ACL table and the fact or dimension table that needs to be filtered.

With the JOINs set up properly, you place the RLS Rule not on the ACL table, but on the fact and dimension tables. You will be able to reference the fields within either table.

Expand Down
4 changes: 2 additions & 2 deletions modules/ROOT/pages/common/nav.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -18,10 +18,10 @@
** link:{{navprefix}}/deprecated-features[Deprecation announcements]

* Live Playgrounds
** +++<a href="{{previewPrefix}}/playground/search" target="_blank">Visual Embed Playground</a>+++
** +++<a href="{{previewPrefix}}/playground/search" window="_blank">Visual Embed Playground</a>+++
** link:{{navprefix}}/restV2-playground?apiResourceId=http%2Fgetting-started%2Fintroduction[REST API v2 Playground]
** link:{{navprefix}}/graphql-play-ground[GraphQL Playground]
** +++<a href="{{previewPrefix}}/api/rest/playgroundV1" target="_blank">REST API v1 Playground</a>+++
** +++<a href="{{previewPrefix}}/api/rest/playgroundV1" window="_blank">REST API v1 Playground</a>+++
** link:{{navprefix}}/spotdev-portal[How to use]
*** link:{{navprefix}}/dev-playground[Visual Embed Playground]
*** link:{{navprefix}}/graphql-playground[GraphQL Playground]
Expand Down
4 changes: 2 additions & 2 deletions modules/ROOT/pages/css-customization.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -253,7 +253,7 @@ customizations: {
. Click **Run**.

++++
<a href="{{previewPrefix}}/playground/fullApp" id="preview-in-playground" target="_blank">Try it out</a>
<a href="{{previewPrefix}}/playground/fullApp" id="preview-in-playground" window="_blank">Try it out</a>
++++

== Additional resources
Expand Down Expand Up @@ -303,7 +303,7 @@ customizations: {
. Click `Run`.

++++
<a href="{{previewPrefix}}/playground/fullApp" id="preview-in-playground" target="_blank">Try it out</a>
<a href="{{previewPrefix}}/playground/fullApp" id="preview-in-playground" window="_blank">Try it out</a>
++++

== Customization steps
Expand Down
2 changes: 1 addition & 1 deletion modules/ROOT/pages/custom-actions-callback.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -357,4 +357,4 @@ Custom actions appear as disabled on unsaved charts and tables. If you have gene

////
* link:https://github.com/thoughtspot/ts_everywhere_resources/tree/master/example_actions/download_csv[Custom action examples, window=_blank]
////
////
Original file line number Diff line number Diff line change
Expand Up @@ -103,4 +103,4 @@ To delete a custom action association:
. Click the *Custom actions* icon image:./images/custom-action-icon.png[the Custom actions menu].
. In the **Custom actions **panel, click the delete icon next to that action that you want to remove.

For information about deleting a custom action assigned at the Worksheet level, see xref:custom-actions-worksheet.adoc[Add custom actions to a Worksheet].
For information about deleting a custom action assigned at the Worksheet level, see xref:custom-actions-worksheet.adoc[Add custom actions to a Worksheet].
2 changes: 1 addition & 1 deletion modules/ROOT/pages/customize-text-strings.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ init({
});
----

+++ <a href="{{previewPrefix}}/playground/fullApp" target="_blank">Try it out </a> +++ in the Visual Embed Playground to preview the customization.
+++ <a href="{{previewPrefix}}/playground/fullApp" window="_blank">Try it out </a> +++ in the Visual Embed Playground to preview the customization.

== Limitations
Note the following limitations: +
Expand Down
Loading