Implementing Security Using Junction Object on External Data In Einstein Analytics

Background

Einstein analytics is a power analytics engine that allows you to explore and create analytics dashboards with Salesforce as well as external data. Analytics dashboards and datasets can be created from Salesforce data, external data through connected systems or external data imported using csv files. 

Salesforce advertises that Einstein supports row level security on data sets using either inherited sharing from Salesforce data or using security predicates for custom security mode. More information on these are available in the following links:

• Security using Inherited Sharing
• Ownership based sharing using security predicates

In the below solution I aim to describe a solution for implementing security on external datasets that are related to Salesforce data that follow a custom security model facilitated through junction object. Essentially a many-to-many sharing model in which many users have access to many records in the external data set.

Solution (Github)

Security Model

In our example the Account object will be used to link to external data. Custom security model is implemented on the Account object using a junction object called User Account Assignment. The key point in the security model is that a single account can be shared by multiple users. The diagram below shows a visual representation of the security model.

In the above example User 1 has access to Account 1 and User 2 has access to Account 1 and Account 2. The below screenshot shows the User Account Assignments in my analytics developer org which I will use to implement the security in Einstein analytics on an external dataset of orders that relate to the account record using the account number.

Analytics Setup

The snapshot of the orders dataset we will be using in our demo is shown below. The key field in the dataset is the Account_Number field which maps the order to a Salesforce account record. 

The key to the solution is to extract the User Account Assignment records (formula field to expose account number for join key is needed) and join the external orders dataset using the account number. The purpose of the join is to add a user id column to the joint dataset to allow us to a use a security predicate to filter to rows with logged in user's id. The dataflow and the definition (.json) in the dataflow are shown below. The dataflow creates a joint dataset that replicated order rows for every user account assignment that is matched.

OrdersWithAccountAssignments.wdf

{
  "sfdcDigest_UserAccountAssignment": {
    "action": "sfdcDigest",
    "parameters": {
      "fields": [
        {
          "name": "Account_Number__c"
        },
        {
          "name": "User__c"
        }
      ],
      "object": "User_Account_Assignment__c"
    }
  },
  "OrdersWithUsers": {
    "action": "sfdcRegister",
    "parameters": {
      "name": "OrdersWithUsers",
      "alias": "OrdersWithUsers",
      "source": "augment_OrdersWith"
    }
  },
  "edgemart_Orders": {
    "action": "edgemart",
    "parameters": {
      "alias": "Orders"
    }
  },
  "augment_OrdersWith": {
    "action": "augment",
    "parameters": {
      "right_key": [
        "Account_Number__c"
      ],
      "left": "edgemart_Orders",
      "left_key": [
        "Account_Number"
      ],
      "right_select": [
        "User__c"
      ],
      "right": "sfdcDigest_UserAccountAssignment",
      "relationship": "UserAccountAssignment",
      "operation": "LookupMultiValue"
    }
  }
}

In the above definition json you can see the that the order records are augmented with the User Account Assignment records using the Account_Number__c key and registered into a new dataset called OrdersWithUsers. This dataset is the joint dataset where we will apply the security predicate to filter the records according to the user. The below screenshot shows the security predicate and the dataset properties.

Demo

For the purposes of the demo we have setup the User Account Assignment records as shown below. So orders associated with Test Account 2 and Test Account 3 will be shown if logged in as me and Test Account 1 and Test Account 2 orders will be shown if logged in as the Test Analytics user in the OrdersWithUsers dataset created with the security predicate applied. The demo video below the screenshot confirms the same.

Conclusion

In conclusion Einstein analytics provides ways to implement security on extracted salesforce data and external data using sharing inheritance and ownership rules. But if your application is using a custom many to many sharing implementation using a junction object. Then special steps need to be taken to output a dataset where a security predicate based on the logged in user can be applied. Hopefully this blog and the repository will help you if you are having issues implementing sharing for a custom security model.