Quick BI:Security Enhancement Solution for Permissions on Reports and Parameter Passing of Report Embedding

Background information

Quick BI provides a security-enhanced embedded analysis solution, called Ticket Report Embedding Solution for short. When you use the Professional Edition of Quick BI, you can implement one-stop security control for multiple scenarios, such as linking, accessing, and viewing data. This solution helps you integrate with enterprise business systems at low costs and efficiently build data products with your own brand features.

Usage notes

To use the Ticket report embedding solution, you need to pay attention to the following points:

• Currently, you can embed only dashboards, worksheets, dashboards, and self-service data retrieval reports into other systems.

• If you need to try out the global parameter capability, contact the person in charge of Quick BI operations.

• The enhanced solution for the international site only supports sites in Singapore and China (Hong Kong).

  Note

  The domain names of the Singapore and Hong Kong sites are as follows:

  • Singapore: bi-ap-southeast-1.data.aliyun.com

  • Hong Kong, China: bi-cn-hongkong.data.aliyun.com

  In this topic, the domain name of the China (Hong Kong) region is used as an example. If you use other websites, replace it with the domain name of the corresponding website.

Step 1: Open the report to be embedded

The report embedding feature is supported only when the report is in the published state.

Step 2: Use an API operation to generate an AccessTicket ticket

1. Call the CreateTicket interface to generate the ticket to be used for report embedding.

   The following table describes the parameters for generating an accessTicket.

   Option	Job type	Full description
   WorksId	String	The ID of the embedded report. Currently, only dashboards and workbook are supported.
   CmptId	String	The ID of the component. is the ID of a component in the preceding report. For more information about the interface called to obtain the component ID, see QueryWorksBloodRelationship.
   TicketNum	Integer	The number of tickets. Default value: 1. The recommended value is 1. The maximum value is 99999. Each time a ticket is used to access the ticket, the number of tickets is reduced by 1.
   UserId	String	The Quick BI UserId, which is not the ID of your Alibaba Cloud account. You can call the QueryUserInfoByAccount operation to obtain the UserId. UserId is fe67f61a35a94b7da1a34ba174a7****. Note You can specify only one of UserId and AccountName. If you do not specify this parameter, the owner of the report is bound by default. For more information about how to configure row-level permissions, see Appendix 1: Configure row-level permissions.
   AccountName	String	The account name of the user. If the user is an Alibaba Cloud account wangwu, the format is [primary account], such as wangwu. If the user is a RAM user zhangsan**@aliyun.cn, the format is [primary account: sub-account], for example, wangwu:zhangsan **. Note You can specify only one of UserId and AccountName. If you do not specify this parameter, the owner of the report is bound by default. For more information about how to configure row-level permissions, see Appendix 1: Configure row-level permissions.
   AccountType	Integer	The account type of the user. 1: Alibaba Cloud account 3:Quick BI a user-created account 5:RAM sub-account Note If AccountName is not empty, AccountType also cannot be empty.
   ExpireTime	Integer	The time when the backup expires. Unit: minutes. Default value: 240
   WatermarkParam	String	The watermark parameter of the report. It must not exceed 50 characters.
   GlobalParam	String	The global parameters of the report filter. The value is a JSON string Note If you need to use the global parameter capability, contact the person in charge of Quick BI operations.

   Note

   • Link sharing prevention control: We recommend that you set the value of TicketNum to 1, which indicates that the generated third-party embedded link is accessed only once.

   • The watermark parameter WatermarkParam can be bound when the report is embedded.

2. Generate an AccessTicket.

   For more information about the sample code, see SDK examples.

   Sample response:

   {
     "requestId" : "7D784AB0-5B77-077E-B628-E782B58D3898",
     "result" : "fd138bcb-****-4fde-b413-81bcee59bdb6",
     "success" : true
   }

   Note

   The result is the AccessTicket generated for this API call. The AccessTicket is the fd138bcb-****-4fde-b413-81bcee59bdb6.

Step 3: Create a logon-free URL

https://bi-cn-hongkong.data.aliyun.com/token3rd/report/view.htm?id=<42****18ef6>&accessTicket=fd138bcb-****-4fde-b413-81bcee59bdb6&cmptId=XXX

1. Obtain the Quick BI domain name.

   For example, Quick BI the domain name of the China (Hong Kong) site is bi-cn-hongkong.data.aliyun.com, the environment-specific domain name prevails.

2. Gets the preview report URL.

   The URL of the preview page corresponding to the report is as follows. You can select the URL as needed.

   • Dashboard: token3rd/dashboard/view/pc.htm

   • spreadsheets: token3rd/report/view.htm

   • Data dashboard: token3rd/screen/view/pc.htm

   • Self-service data retrieval: token3rd/offline/view/pc.htm

3. On the report editing page, obtain the report ID.

   • The ID of the dashboard. In this example, the value is d01****c5f.

     On the dashboard edit page, obtain the value of the dashboard pageId in the address bar.

     

   • The ID of the workbook. In this example, d0****3ba88

     On the workbook editing page, obtain the value of the workbook Id in the address bar.

   • The ID of the data dashboard. In this example, 3c****26b

     On the Data Dashboard page, obtain the value of pageId in the address bar.

     

   • The ID of the self-service data retrieval. In this example, the ID is b2****47.

     On the download editing page, obtain the value of pageId in the address bar.

     

4. Add the Quick BI domain name, preview report URL, report ID, and AccessTicket obtained in Step 2 to the following request URL.

   • https://<Quick BI domain name>/<preview report URL>?pageId=<report ID>&accessTicket=<AccessTicket>

   • https://<Quick BI domain name>/<preview report URL>?id=<report ID>&accessTicket=<AccessTicket>

   • https://<Quick BI domain name>/<preview report URL>?pageId=<report ID>&accessTicket=<AccessTicket>

   • https://<Quick BI domain name>/<preview report URL>?pageId=<report ID>&accessTicket=<AccessTicket>

Appendix 1: Configure row-level permissions on data

If the UserId and accountName parameters are not specified, the view permission of the embedded report follows that of the report owner by default. You can follow the instructions in the following figure to configure row-level permissions and set UserId or AccountName parameters to bind the permissions of the target user. For more information, see Row and column permissions.

Appendix 2: Generate global parameters

Set the corresponding global parameters in the target dashboard or workbook. The global parameters are used to bind reports and generate AccessTicket.

[
  {
    "paramKey": "price", // The global parameter key.
    "joinType": "and", // The connection method.
    "conditionList": [
      {
        "operate": "=", // The operator. For more information, see the following
        "value": "1" // The operation value. In the case of multiple values, the array ["1", "2"] is used.
      },
      {
        "operate": "=", // The operator. For more information, see the following
        "value": "2" // The operation value. In the case of multiple values, the array ["1", "2"] is used.
      }
    ]
  },
  {
    "paramKey": "area", // The global parameter key.
    "joinType": "and", // The connection method.
    "conditionList": [
      {
        "operate": "in", // operator
        "value": ["North China","South China"] // The operation value. If multiple values are specified, an array is used.
      }
    ]
  }
]

Appendix 3: Quantity of Reports that Can Be Embedded