Signing and security for sensitive tiles

When a tile queries data from external data sources, security measures are needed to prevent a malicious user from having SquaredUp DS execute unauthorized queries and scripts.

The following tiles query data from external data sources and are considered sensitive tiles:

  • SQL tiles query SQL databases
  • Web API tiles query external Web APIs
  • PowerShell tiles run PowerShell scripts

Signing for sensitive tiles

To make sensitive tiles that access external data sources more secure, SquaredUp DSuses signing. When a SquaredUp DS admin creates a sensitive tile, it is automatically signed, meaning the JSON config of the tile contains a cryptographically hashed signature.

Signing fulfills two functions:

  • Since signing makes sure that a query or script has been created by a SquaredUp DSadmin, the SquaredUp server trusts them to be safe to run and show the results to users viewing a dashboard, even to unauthorized users viewing an Open Access dashboard.

  • Since tiles are only signed when they are created by SquaredUp DS admins, signing prevents SquaredUp DS users from creating or editing queries or scripts for tiles that access external data. Even if a user can author dashboards due to their Team Folder permissions, they can't create or edit queries and scripts in sensitive tiles.

Security factors for sensitive tiles

There are three factors to consider regarding security for those tiles:

  • Who can create and edit the query or script?
  • What identity is used to run the query or script?
  • Who can see the results?

Who can create and edit the query or script?

By default, only SquaredUp DSadmins can create and edit dashboards and perspectives, which means only them can create and edit queries and scripts. When an admin creates or edits a sensitive tile, it is automatically signed.
If you are using Team Folders, you can allow SquaredUp DS users to edit dashboards in a Team Folder by giving them the Author or Owner role for it. Being able to edit tiles in a dashboard means the user also has access to sensitive tiles:

What happens if a SquaredUp DS user tries to create or edit queries or scripts?

What happens after a user tries to create or edit queries or scripts depends on your version of SquaredUp DS.

In version 4.4 and below:
When a SquaredUp DS user creates or edits a sensitive tile, the tile is permanently marked as untrusted. The tile no longer functions until a SquaredUp DS admin restores the signing of the tile. Before restoring the signing, users can't see the result of queries and scripts in the tile, even if an administrator further modifies it and publishes it. This is to prevent the accidental execution of untrusted queries.

In version 4.5 and above:
Any changes by a SquaredUp DS user to sensitive queries or scripts are not saved. Users will see one or more of the following errors:

  • An error occurred. Current user does not have permissions to modify sensitive tiles
  • You do not have permission to author or modify sensitive queries
  • You do not have sufficient permissions to access this resource

After making disallowed edits to a sensitive query any change (to the query or the rest of the dashboard) cannot be saved. Any further changes to the rest of the dashboard made after the disallowed edits to the sensitive query will also be lost. The user has to click the invalid changes button and then discard to discard the disallowed changes.

Enabling a SquaredUp DS user to create and edit queries and scripts

The easiest way to enable a user to create and edit sensitive tiles is to turn them into a SquaredUp DS admin. In the rare case that you want the user to be able to create and edit sensitive tiles but don't want to make them a SquaredUp admin, you can give them permission to do so (and therefore permission to sign tiles).

  1. Make sure the user has the Team Folder role Author or Owner for the dashboards you want them to be able to edit.
  2. Give the user permission to sign tiles.
    Note: This feature should be used with caution. If you give a user permission to sign tiles, they can write, edit and execute any query and script (SQL, Web API and PowerShell). This can result in sensitive information disclosure or even data loss.
  3. Only for version 4.4 and below: Giving a user permission to sign tiles does not affect dashboards that have already been authored by that user. If a user already authored sensitive tiles and caused them to be untrusted, the signing of those tiles must be restored. This can be done by either deleting and re-creating individual tiles or the entire dashboards, or by restoring the signing in the JSON of the affected tiles.

What identity is used to run the query or script?

It depends on the tile and their settings how queries and scripts are run:

Tile
Queries/Scripts are run as:
SQL tiles
SquaredUp DS app pool identity (unless documented otherwise)
Web API tiles
SquaredUp DS app pool identity (unless documented otherwise)
PowerShell tiles
Run As account of the tile (by default, SquaredUp DS app pool identity)

Example: If the SquaredUp DS app pool identity is MY SERVICE ACCOUNT, queries will always be performed by MY SERVICE ACCOUNT on behalf of the user, regardless of which SquaredUp DS admin created the query or which SquaredUp DS user is viewing the dashboard.

Limiting or scoping the data available to this identity is one method of securing external data sources.

Who can see the results?

Since signing makes sure that a query or script has been created by a SquaredUp DSadmin, the SquaredUp server trusts them to be safe to run and show the results to users viewing a dashboard, even to unauthorized users viewing an Open Access dashboard.

Known issues

In v4.5 and above dashboard edits after making disallowed changes to a sensitive query are lost

See What happens if a SquaredUp DS user tries to create or edit queries or scripts?

In v4.4 and below unsigned queries are untrusted until modified

See What happens if a SquaredUp DS user tries to create or edit queries or scripts?

Permission changes do not affect dashboards already authored

Only for version 4.4 and below: Giving a user permission to sign tiles does not affect dashboards that have already been authored by that user. If a user already authored sensitive tiles and caused them to be untrusted, the signing of those tiles must be restored. This can be done by either deleting and re-creating individual tiles or the entire dashboards, or by restoring the signing in the JSON of the affected tiles.

Enabling Open Access can disable previously working queries

If a non-administrator enables a dashboard for Open Access (see Sharing Dashboards with anyone - Open Access), any queries on the dashboard (even if they were authored by an administrator) will become untrusted and disabled in the process.

To amend this, an administrator has to restore the signing of the affected tiles.

Was this article helpful?


Have more questions or facing an issue?