Migrating Roles and Permissions from OpenMetadata to Qlik (with SSO)

[aarashj]

Discussion Problem Statement

In our project, the roles and permissions model is defined in OpenMetadata and then centrally migrated to a PostgreSQL database. The goal is to integrate these centrally managed access permissions into Qlik Sense (or QlikView) to provide a consistent, secure, and low-maintenance access control mechanism for reporting and analytics. In addition, we aim to implement Single Sign-On (SSO) to centralize user authentication via an external Identity Provider (such as Active Directory, LDAP, or SAML).

This integration presents several challenges: extracting and transforming the permissions data from PostgreSQL into Qlik’s Section Access format, ensuring seamless connectivity with an external Identity Provider for SSO, and automating reload tasks so that Qlik always reflects the latest permissions. There are also potential pitfalls—like handling duplicate entries and ensuring that field names are consistently converted to uppercase within Section Access.

---

Specific Questions

1. Best Practices and Architecture:

   • What are the best practices for integrating a centralized roles and permissions concept (created in OpenMetadata and stored in PostgreSQL) into Qlik Sense/QlikView?
   • Are there any reference architectures or case studies available that validate this approach?

2. Data Integration and Transformation:

   • What specific steps and data transformations are required to extract the access rights from PostgreSQL and load them into Qlik’s Section Access?

3. SSO Implementation:

   • What is the recommended approach to set up Single Sign-On (SSO) in a Qlik environment so that Qlik automatically utilizes authentication details from an external Identity Provider?
   • What challenges or integration points (e.g., mapping user identities, handling SAML claims) should be considered?

4. Automating Reload Tasks:

   • What challenges are commonly encountered when automating Qlik reload tasks to ensure that the PostgreSQL-based access permissions remain current?
   • Are there any recommended strategies or tools to streamline this process and minimize manual intervention?

5. Risks and Pitfalls:

   • What are the known risks or pitfalls when centrally managing access rights in PostgreSQL that might affect integration with Qlik?
   • How can issues like case sensitivity (uppercase conversion in Section Access) and duplicate permission entries be mitigated?

6. Practical Experiences and References:

   • Are there any community experiences, GitHub repositories, or documented implementations that demonstrate a successful integration of a centralized roles and permissions model into Qlik with SSO?
   • What practical advice or lessons learned can be shared regarding this integration process?