PBI Gateway: Best practices to manage gateway connections

[alfBI]

Dear colleagues,

Imagine an scenario where a user (e.g: UserHR) publishes a PBI desktop file on the service. The dataset does contain several on-premises sources so the gateway connection has to be properly setup in order to schedule it refresh. Once published the dataset is owned by UserHR by default.

On the other hand, the on-premise gateway is already installed and the datasources required by the aforementioned dataset has been already created by the userIT (with admin permission on the gateway)

With regards the existing data sources defined on the gateway,  both user accounts (userHR & userIT) are defined as User 

At that point we foresee at least 2 ways to handle the configuration of the gateway connections:

Scenario 1: IT Centralized-Governance: Once published the userIT takes ownership of the dataset and because he is Gateway admin he might configure the gateway connection by maping the on-premise datasources with the corresponding datasources created on the gateway. User1 will be able to consume the content as he has rights over the gatway connection

Scenario 2: De-centralized. UserHR  remains as owner of the dataset and he would configure the gateway connection on its own.

Question (that raised this post) is:

which permissions will userHR need? The minimal one seems to be the one named "Connection Creator" but this one would allow him to create additional sources on the gateway. We would aim that userHR was able to map dataset on-premise datasources with existing gateway data source entries, but not to create new ones (in few weeks we would end with dozens of data sources created by the end users.....). Is that feasible?

Any suggestion about the best practice to be followed to handle setup of gateway connections and gateway roles will be more than welcome. Main question behind is: how to achieve a non-dependency of IT for the task withoout put in risk the "integrity" of the data sources existing on the gateway (that should be only managed by IT)

Thanks,

Alfons

Regards,

[mhaindl]

This is utterly broken. We aim for a similar solution as alfBI. userHR should be able to update or change its gateway connection without adding new connections to the gateway. It literally says so in the "manage users" tab: "Allows the userto use the data source, manage data sourceconfigurations and credentials."

The fact, that you also need userHR to be connection creator is a broken logic. 
You should be able to manage ALL gateway connections and create new connections on the gateway: be admin
You should be able to manage YOUR gateway connection and create new connections on the gateway: be connection creater and owner
You should be able to manage YOUR gateway connection but can't create new connecitons: be owner
None of the above but can use connection: be user

I'm fairly upset that this feature sounds so promising and is so critically broken at the same time.

[arvindsingh802]

Best practice is
1. Developemnt team will be owner of the dataset and will reach to IT team for any addition/updation of datasource

2. IT team will be the Admin of gateway/s and will be creating datasource as per request and give the requestor "User access" for requested data source

[alfBI]

So, in your described scenario the developer team will be able to map the data source identified in the dataset with the gateway datasource without requiring additional right?

[arvindsingh802]

Yes, If the data source is already added in gateway by IT team and Dev team have user access to that data sources

In above senario Developer (User CA) has user access so he/she will be able to map this data source without any additional rights

If there is a new data source, they will reach out to IT team and request to get that added and also get user access to that data source