About Associating Connections with Projects in Dataiku

Tosihiro

Hi,

In Dataiku, connection settings can be linked to user groups, but I believe they cannot be linked to projects. I have a question regarding this:

If UserA belongs to both the Finance and HR user groups, UserA would have access to connections associated with both of these groups. This situation can easily lead to unintended data mishandling. For example, when UserA is working on a recipe handling HR data, it is quite possible to mistakenly set the output connection to one linked to Finance. This could result in unintentional data accidents.

I believe that associating projects with specific connection settings in Dataiku, so that only certain connections are listed for a particular project, would be the most effective way to prevent this. However, currently, this is not possible in Dataiku.

I think this is a relatively common use case. Could you please advise on the standard configuration in Dataiku to handle data more safely?

P.S.: I have referred to the following community answers, but I do not believe I have received a satisfactory solution:

Forcing a connection(s) on project

Tomas

Dec 15, 2020

Is it possible to force (limit) only a set of connections to be used in the project?

I tried to change the option "Preferred connection (forced)" to in Project's settings, but it looks to me that DSS still allows me to create datasets on other connections as well.

Thanks

---

View Post

Preventing users from accessing managed datasets as input

VickeyC

Mar 14, 2022

We are planning on using SQL Server tables as part of our managed datasets, setting the "schema name" field in the connection to the project key. This works well so far for managed datasets -- it's easy to identify all of the tables belonging to a particular project, and it prevents the users from inadvertently overwriting another project's dataset. The problem is, users who have access permissions to multiple projects can pull in managed datasets from other projects as input datasets.

Is there any way to prevent this? (e.g. a hook or a plugin?)

---

Operating system used: RHEL 7.9

---

View Post

Tsuyoshi

Hi @Tosihiro, perhaps you can use a 'Connections/Projects restrictions plugin'. Though, there are some caveats, please consider the following points and decide whether to use it or not.

• The plugin is not officially supported (Tier 2 support)
• Once the “Explicit mode” is enabled, all the connections are prohibited unless the projects are specified in the "allowed list" of each connection.

It looks like the document link in the plugin details does not work, so please refer to this link.

Tosihiro

Hi @Tsuyoshi ,

Thank you for providing the solution. I greatly appreciate your support and will try it out immediately.

Best regards,

Turribeach

I wasn't aware of this plugin and it is pretty cool that this can be supported in such way but in my view this makes the Administration of the security model a bigger overhead. Since the original poster is trying to prevent "unintended data mishandling" my approach would be to monitor projects using the Dataiku Python API which can easily detect which connections are being used in each project.