I have been trying to dynamically change the looker connection using user attributes. Here the database connections are SIEM databases namely siem_1 and siem_2. I created a user attribute named db_connection and under the “user values” tab I have assigned myself the “siem_1” db_connection value and another member of the team “siem_2”. Then I went to the model file to change the connection and this is where I got stuck. Here connection variable takes only a string value in the form of a connection name. So if I use: 1) connection: {{_user_attribute[“db_connection”]}} → it says that it should be string 2)connection: “{{_user_attribute[‘db_connection’]}}” → it throws a model error as it is not one of the model connections i.e., siem_1 and siem_2
Some other solutions that I thought to solve this problem include creating a manifest file and adding the constants there but it doesn’t seem to work either.
Kindly help me out with this problem and provide some solutions. I have been stuck on this for quite some time now. I also request Google to have example code snippets along with explanations in their documentation as it would make understanding use cases a lot easier.
Yes, user attributes can be used to dynamically change the connection based on the user. However, it cannot be used in the “connection” parameter as you’ve attempted. Using liquid can only be used in LookML in the places noted in this link. To accomplish what you’re looking to do, you will need to add the user attribute in the database connection (i.e. Admin menu → Connections).
Hi thanks for your input! I tried what you suggested today but I’m still a bit confused about the entire process of it. So, I went to admin connections as you mentioned:
As I mentioned earlier I created a user attribute named db_connection and under the “user values” tab I have assigned myself the “siem_1” db_connection value and another member of the team “siem_2”. This user attribute ( “Db Connection”) which you can see is one of the options available when I clicked the button available on the right side of “Dataset” field. In the brackets I am able to see the string or db name (“siem_1”) that I assigned to myself. But shouldn’t I directly choose the db name here? or the user attribute will work just fine? or should I choose some field other than “Dataset” to assign the user attribute to? Just wanted to know if I am going in the right direction. Also if you could explain the process about how it would work in real time or provide a documentation for the same, it would help a lot. Thank you!
What you’re doing is correct. You should be able to test this by running a report as yourself from an Explore built on the model that uses this connection. Then you can sudo as the other (i.e. the one with the “siem_2” database user attribute value) and running the same report. you should be able to look at the SQL in the queries and verify the FROM clause is sourcing from the different databases.
Handle this by extending the model file and using a different connection in there. Permission the different users to see the specific model file (and therefore connection) that they need.
Correct. You can not extend model files - Documentation
You can use extend Explores inside of model files (and/or use Refinements), but you can not extend the model file itself (e.g. to use different connections). User attributes, as described above, would be the way to do this.
Create a model file, remove connection, change the extension of the file so it doesn’t include .model (we call ours .base) and then just include the base file in a real model file with the connection you want to use. Do this multiple times for the combo of people access and connections. Same base lookml for everyone, different connections per model.
That’s right. You would need two different models, each with different connections, to authenticate two different ways.
You can still share LookML files between the two models. Often this is done by moving your explores to their own files, and including them in both models - the same way you have views in view files and include them. The “Create Generic LookML File” option, along with a “explorename**.explore**” name on the file name, will even give it a special icon in the file browser.
well, yes, you need two different dashboards, but they could be a single LookML dashboard file included into both models. You just need to remove the model: property from all the LookML dashboard elements for this to work.
I think @vemireddy is saying that it is manual. The change is “dynamic” but not “automatic.” You go to manifest and change the connection associated with the constant @{CONNECTION_NAME}. You could just as easily update the connection right in the model file.
This process would require you to remember to “put it back” when you change the connection in dev mode. However, you could add a linter step to make sure you have done this prior to merging back to prod.
If you have multiple Looker instances to manage this, then it is far easier, since you can use user attributes as environment variables.
I see now you want to have tighter controls in dev mode. I usually recommend simply not restricting your devs when in dev mode, but instead only allow them to edit models they ought to have full access to. In other words, if there are connections with service accounts too powerful for some developers, those models which use those connections should be in a different project.
