What determines access to embed spaces/folders?

[chris_seymour1]

Knowledge Drop

Last tested: Jun 17, 2019
 

Navigating and saving content to folders in the embed context works a bit differently from doing so in the UI.  The first thing to note is that folder pages cannot be embedded directly.  Instead, embed users access the folder menu through the "four squares" icon at the top right corner of an embedded look, dashboard, or explore:

 

Note that this applies only to Legacy dashboards; folder navigation has not yet been built out for Dashboards-Next dashboards.

The embed_browse_spaces permission gives embed users access to this embed folder menu. Non-embed users, even with the embed_browse_spaces permission, are not supposed to see the embed folder menu on embedded content. As of May 2021, the folder menu is not yet available on Dashboards-Next. The three icons on the left represent three main folders that the embed user can navigate:

1. Personal - All embed users with the embed_browse_spaces permission are automatically given Manage Access / Edit permission on a personal folder where they can view or save content for themselves.  Admins can view and manage access to this folder in the UI under the top-level Embed Users folder.
2. Group - Embed users who are created with the optional external_group_id parameter are given Manage Access / Edit permission on an embed group folder where they can save content for their embed group. Admins can view and manage access to this folder in the UI under the top-level Embed Groups folder. Embed users can only be given access to this folder through the embed URL, but once they have access, admins can change the access level to View to remove their ability to save/edit content in that folder.
3. Shared - The Shared folder in the embed folder menu is the same Shared folder that regular Looker users browse in the UI. Therefore, both admins and non-admins with Manage Access / Edit permission on a shared folder can manage access levels for embed users through the same process they would for regular Looker users—using the Manage Access option in the gear menu at the top right corner of the folder page. To prevent embed users from accessing the global shared folder (not their group shared folder) you can manage access on the Shared folder to only grant access to non-embed users. To do this, you can create a new group, i.e. "Users with Access to Shared folder" and add all non-embed users to it. In Admin --> Content Access, you can then manage access on the Shared folder and add this new, non-embed user group to it.

This content is subject to limited support.