Custom User Profile Fields and be able to use them as Trusted Attributes for PDP

swagner · 2022-01-14T21:06:30+00:00

There was an error rendering this rich post.

I think it would be extremely useful to have the ability to add custom user profile fields. For example I have people that cover geography that's not just based on the "location", some cover districts. Also have users who back up certain sales people. If I could add custom fields to match values against our data I could build more PDP policies to make each users experience fit their needs with less effort.

Today I am accomplishing this by setting up individual PDP policies with each user named. If I could set it up based on additional trusted attributes it would be more dynamic when a users coverage changes, or new users are added.

Find more posts tagged with

Implemented

Status: Implemented

Comments

Ashleigh

@swagner I agree, custom trusted attributes would be nice.

TheLookout

This is something that I would love to see implemented.

erikjamesmason

we're currently in a situation where this would greatly improve our governance. please make this a thing, Domo!

TheLookout

This has come up in our workflow again and would drastically improve Domo for our end users. Please, work on this as soon as you can.

McSQL

I will share this, it is always helpful to have the community submit the feedback as well directly (under "More ->FEEDBACK). This feedback is reviewed by the Domo team.

Screen Shot 2023-03-01 at 12.20.02 PM.png

DomoDork

I know this thread is a bit old, but I'd like to add my thoughts on this feature. While it seems we can now define our own attributes which is really nice, it still requires those values come from IDP/SSO if you want those new attributes to be automatically inherited and locked down so the values on the profile cant be edited.

In my company, our PDP is very complex and we have a concept called data personas. Essentially, any given employee can where multiple 'hats' and may have 2 or more data personas. Each persona determines what datasets they have access too, as well as what data is visible. This allows us to give different filtering and object visibility rules to the same user depending on a given dataset. So his/her first data personas may allow them to see a 'Finance' dataset and have PDP filtering rules specifically tailored to that finance dataset. While the other persona allows them to see 'Operations' datasets with different PDP rules tailored to that persona.

So what would solve all of this in my world would be two things:

Allow custom attributes to be table driven just like PDP automation that we can control to supplement any IDP provided attributes. In large companies, sometimes its not feasible or IT restricted where adding data to peoples SSO/ActiveDirecty/IDP profiles isn't allowed. That way we can put 'rules' in this table that contain the user, the name of a custom attribute, and the value we've set for them. Those then show up on their profiles and the trusted attributes screen and can be leveraged for PDP.
Allow attributes to have sub attributes. This way, I can have a 'Data Persona' custom attribute, that also has sub attributes.

For example, lets say we have a Manager who has 2 personas. One called 'Ops Manager', one called Financial. It would be nice to see this kind of setup (everything in bold is a custom attribute, anything next to a minus sign would be a custom sub-attribute)

Data Persona

- Name | Finance

- Country | USA

- State | New York, Texas, California

- Name | Ops Manager

- Region | Southwest

This would allow me to greatly simplify PDP since I can infer their attributes directly. For every finance dataset, I can just add basic dynamic rules to my PDP table by putting a value like "domo.policy.managed_data_persona.name.finance" and PDP would automatically unfold the sub attributes to filter the data where the Country is USA and the States are New York, Texas, California. You could even have situations where you want BOTH personas taken into account for filtering. So you might do "domo.policy.managed_data_persona" and then all the sub-attributes are taken into account as OR rule evaluations so this user would see data where they see USA, New York, Texas, California OR where the Region is Southwest on the same dataset.

Where as right now, I have to generate individual rules/policies for each individual user for every dataset, every column and every value that they are allowed to see based on our internal persona data. It ends up being millions of rows to manage, and keeping up to date when their profiles change or they move to a different role/area of the business etc.

Apologies for the longwinded post. I just feel like PDP and Attributes could go much further and be much more flexible than they are today.

Thanks!

DanBrinton

Hi, all,

Thanks for the feedback here! As you may already know, Domo has release custom trusted/managed attributes. Please have a look at the KB here: https://domo-support.domo.com/s/article/000005164

@DomoDork, this is an interesting idea about an attribute hierarchy. Can I suggest you post your comment again in a new thread so others can respond to it?

TheLookout

@DanBrinton Is there any information on these custom attributes being updateable with bulk-updates? The link you shared says that it is being looked into, I'm just hoping that it is a functionality that is going to be included.

DanBrinton

Hi, @TheLookout - thanks for the follow-up question.

I'm happy to report that you CAN set custom user attributes in bulk using the User Management tool in the Governance Toolkit. This functionality was released just within the last couple of months.

Please find general documentation on the User Management tool here: https://domo-support.domo.com/s/article/6305057013527 . But note, the documentation doesn't yet specifically reference the custom attribute capability. Read on for more details.

The User Management tool consumes a Domo dataset that contains user information, including attributes. Once you've created an attribute in the Domo instance, you can set values for that attribute by adding a column (column name must be the attribute KEY of the custom attribute - not the attribute name) to the configuration dataset that drives the User Management tool.

For list-type attributes, you can delimit between multiple values using the | (pipe) character

One important note: the attribute must be created in the Domo environment before the User Management tool can set values for it. That is to say, the User Management tool does NOT create attributes.