Sisense Community logo
    • Community Feedback
    • Chapters
    • Events
    • Forums
      • Help and How To
      • Product Feedback Forum
      • Strategy & Use Cases
    • Blogs
    • KB Docs
      • KB Docs
      • Add-Ons & Plug-Ins
      • APIs
      • Best Practices
      • Blox
      • CDT
      • Cloud Managed Service
      • Data Models
      • Data Sources
      • Embedding Analytics
      • How-Tos & FAQs
      • Onboarding
      • PySisense
      • Security
      • Sisense Administration
      • Sisense Intelligence & AI
      • Troubleshooting
      • Widget & Dashboard Scripts
    • Support
    • Learning
      • Sisense Academy: Free Courses and Certifications
      • Official Developer Documentation
      • Official Product Documentation
      • Official Sisense Youtube Channel
      • Sisense Compose SDK Playground
      • Official Sisense Discord
    • Use Case Gallery
    Discussions
    •                    
    •                    
    •                    
    •                    
    •                    
    •                    
    •                    
    •                    
    •                    
    •                    
    •                    
    •                    
    •                    
    •                    
    •                    
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
    Discussions
    • TagsChevronRightIcon
    Deployments
    • Blog banner
      • News & UpdatesChevronRightIcon

      Choosing the Right Replication Strategy: Evaluating ADF + CDC vs. Snowflake Openflow

                                                       

      If you're delivering embedded analytics through Sisense, your dashboard is only as good as the data behind it. But how often do you think about what's happening upstream in the pipelines and ingestion architectures that determine whether that data is fresh, reliable, and cost-efficient before it ever reaches a visualization? QBeeQ is known in the Sisense ecosystem as a plugin and integration provider, but that's only part of what we do. This post is a window into the broader, strategic side of our work: architectural decision-making that happens well upstream of the BI layer but directly impacts the analytics experience your customers see. The client here uses Sisense to deliver embedded dashboards. We built their Snowflake-based data platform from the ground up:  integrations, ELT, data modeling, and governance with Sisense sitting at the top of the stack. The next question became: is our data replication approach from MS SQL Server into Snowflake the right one long-term, or should we move to Snowflake Openflow? A Platform Already in Motion Our relationship with our client didn't start with this POC. We previously helped them design and build a Snowflake-based data platform from the ground up, including data integrations, ELT processes, data models, and governance. That work gave them a solid, modern foundation for their analytics and reporting, including the embedded dashboards they deliver to their customers via Sisense. This POC was the next strategic step in that journey. With the platform stable and maturing, the question became: are we using the best possible approach for replicating data from their MS SQL Server into Snowflake? And more specifically, should we continue developing our custom ingestion approach, or move toward a more ready-to-go solution using Snowflake Openflow? Our client’s business depends on near-real-time data availability. Their operational data lives in MS SQL Server and feeds directly into Snowflake, where it powers analytics and reporting for their customers across retail, telecom, banking, and energy.  These aren't just technical concerns. They directly affect the quality and reliability of the analytics experience delivered to its end customers. The key business drivers behind this evaluation were: Faster availability of incremental data, especially for large transactional tables Lower operational risk and improved robustness Reduced maintenance effort over time Cost optimization at scale Putting Two Approaches to the Test Rather than making a decision based on vendor documentation or assumptions, we designed a structured POC to test both approaches in parallel, on the same three tables and similar data volumes, across four dimensions:  performance cost stability maintainability Option 1: Custom ADF + SQL CDC (Our Existing Solution) The key strength of this approach is control. We define the schema, manage data types, handle transformations during ingestion, and have full visibility into every step of the pipeline. This is the approach we built as part of the initial platform work:  CDC (Change Data Capture) - a native SQL Server feature that tracks only changed rows (inserts, updates, and deletes), eliminating the need to reload entire tables on every run Azure Data Factory (ADF) - Microsoft's cloud orchestration service, used here to move delta data from SQL Server to Azure Blob Storage Snowflake - which then loads and transforms the data using Snowpipe and scheduled tasks It's more engineering-intensive to set up, but the result is a robust, predictable, and highly tunable architecture. Option 2: Snowflake Openflow Openflow is Snowflake's newer, more plug-and-play approach to data ingestion. It uses Change Tracking (CT) on the SQL Server side, a lighter-weight mechanism than CDC,  and ingests data more directly into Snowflake with less custom orchestration required. On paper, it's appealing: faster to configure, fewer moving parts, and tighter integration within the Snowflake ecosystem. But as with any "managed" solution, there are trade-offs. And that's exactly what we needed to quantify. What We Found Performance Both approaches handled initial loads equally well. The gap appeared with delta loads — Openflow's Change Tracking completed incremental updates in 1–2 minutes versus 5–12 minutes for ADF + CDC. For near-real-time use cases, that's a genuine advantage worth noting. Cost This is where the picture shifts dramatically, and where decision makers should pay close attention: Openflow consumed approximately 12.5 Snowflake credits per day, translating to roughly $50/day or ~$1,500/month for this workload alone.  ADF + CDC came in at an estimated $8–15/month   That's not a marginal difference. That's a 100x cost gap on a three-table POC. Now consider what that looks like at scale. Most production environments don't replicate three tables; they replicate dozens, sometimes hundreds. If costs scale proportionally, an Openflow-based architecture could run into tens of thousands of dollars per month for a full production workload, compared to what remains a very modest cost with the custom ADF approach. For a data platform that's meant to be a long-term foundation, the compounding effect of that cost difference is enormous. Over a single year, the gap between these two approaches could easily reach $200,000 or more — money that could instead fund additional data products, analytics capabilities, or engineering capacity. For decision makers evaluating build vs. buy, or assessing the true TCO of a "managed" solution, this kind of analysis is exactly what's needed before committing to a direction. Stability & Maturity The Openflow SQL Server connector was still in preview status at the time of the POC. Runtime and canvas updates caused instability during our testing, and the solution requires ongoing infrastructure coordination. Azure Data Factory, by contrast, is a mature and battle-tested technology with a proven track record in production environments. Architecture & Maintainability Openflow introduced meaningful architectural complexity: requires Snowflake Business Critical edition (for PrivateLink connectivity) adds authentication and data sharing overhead offers limited control over target data types, and  handles soft deletes only, so hard deletes require additional handling Additional Snowflake-side transformations (PARSE_JSON, CLEAN_JSON_DUPLICATES) were also necessary. Our custom ADF solution, while more involved to build: gives full control over schema and transformations  handles deletes cleanly can be extended through a reusable automation procedure that simplifies onboarding new tables over time   Open Flow ADF + CDC Architecture Complexity ⚠️ Requires Business Critical + PrivateLink ✅ Simpler, fewer dependencies Stability  ⚠️ Preview — instability during POC ✅ Mature, production-proven Cost/month ⚠️ ~$1,500 ✅ ~$8–15 Initial load ✅ Comparable ✅ Comparable Delta load speed ✅ ~1–2 min ⚠️ ~5–12 min Onboarding new tables ✅ Fast and easy ⚠️ More setup, but automatable Schema & type control ⚠️ Limited ✅ Full control Delete Handling ⚠️ Soft deletes only ✅ Full delete support Our Recommendation The POC gave our client something genuinely valuable: a data-driven basis for a strategic architectural decision, rather than a choice made on assumption or vendor marketing. Our recommendation leaned toward continuing with the custom ADF + CDC approach as the long-term foundation. Not because Openflow lacks merit, but because the cost differential is substantial, the stability risks are real at this stage of the product's maturity, and the architectural overhead introduces complexity that isn't justified by the performance gain alone. That said, the delta load performance advantage of Openflow is meaningful. As the connector matures and if near-real-time requirements intensify, it remains a viable path to revisit. The POC ensures that if and when that moment comes, the decision will be informed, not reactive. What This Kind of Work Looks Like in Practice In the Sisense ecosystem, you may know us through our plugins and integrations. But this post reflects something equally important: our ability to act as a full-stack data platform partner. What your users see in Sisense is a function of decisions made far upstream. When those decisions lack rigor, the effects show up as latency, data gaps, and rising costs. Running a structured POC like this is often underestimated, but is one of the most valuable things we do for our clients. It's not just about finding the faster or cheaper option. It's about understanding the full picture: performance under realistic conditions, true cost at scale, architectural implications, and long-term maintainability. Every organization's situation is different. The right ingestion architecture depends on your data volumes, latency requirements, existing tooling, team capabilities, and cost constraints.  If you're thinking about your broader data strategy, not just what Sisense can do, but whether everything underneath it is built right, that's a conversation we're well-positioned to have. Thinking about your data platform strategy? Let's talk . QBeeQ is data strategy consulting firm made up of former Sisense employees and customers. We are a Sisense Gold Implementation Partner and Snowflake Select Partner

      Mia Isaacson
      Mia IsaacsonPosted 3 months ago
      0
               
      • TroubleshootingChevronRightIcon

      How to update style sheets in the branding folder for dashboards

                                                               

      How to update style sheets in the branding folder for dashboards Introduction In this article, we will address the issue of updates made to style sheets within a branding folder not reflecting on dashboards. Users often encounter this problem due to browser caching, which prevents the most updated CSS files from loading. This guide provides solutions to ensure your dashboard reflects the latest version of your style sheets. Step-by-Step Guide To resolve the issue of style changes not appearing on your dashboard, follow these steps: Clear Browser Cache: Sometimes, the browser might cache old versions of files, causing it to display outdated data. To fix this: Perform a hard refresh by pressing Ctrl + F5 (on Windows) or Cmd + Shift + R (on Mac). Additionally, manually clear your browser's cache through the browser settings to ensure that it loads the latest version of your CSS file. Rename the CSS File: If clearing the cache does not work, consider renaming your CSS file. By changing the file name (e.g., from base.css to base_v2.css ) and updating the reference in your dashboard, the browser will treat it as a new resource and fetch the latest version. Implement Cache-Busting Techniques: Another effective method is to append a query parameter to your CSS file URL. This technique forces the browser to load the latest version of the file. For instance, modify the link to: https://paragoninsgroup.sisense.com/branding/LossRuns/base.css?v=123456789 . Generate some random string each time to ensure the browser always fetches the latest file.  If you want to handle changes manually, you might want to modify the link to: https://paragoninsgroup.sisense.com/branding/LossRuns/base.css?v=2 . Increment the version number each time you make changes to ensure the browser fetches the updated file. Conclusion By following the above steps, you can ensure that changes made to style sheets in your branding folder are accurately reflected on your dashboards. Utilizing these techniques will help to overcome issues caused by browser caching and ensure your dashboard's appearance stays up-to-date. References/ Related Content How to Clear Browser Cache in Different Browsers For further assistance, please refer to the above resources or contact our support team for personalized help.

      Vicki786
      Vicki786Posted 1 year ago
      0
               
      • APIsChevronRightIcon

      How to activate Sisense license on Linux without web access

                                       

      How to activate Sisense license without web access on Linux This article explains how you can activate a license in your new Sisense installation without access to the Sisense website in the browser. Usual activation In the usual activation, you must navigate to the Sisense URL (printed in the installation logs) to enter your license credentials or specify your offline activation key in the browser. When to use Sometimes, you may want to configure Sisense settings or restore a backup before granting access to the Sisense web application.  Restoring a backup requires your Sisense installation to be already activated. In case you would like to block web access to the application before the backup is restored, you can follow the steps below to activate the license from the server side. Activation steps You will need access to the machine with configured kubectl commands (bastion machine in Cloud installation or cluster machine for on-prem Kubernetes deployments).. Ensure that api-gateway pod is running in the system: kubectl get po -n sisense -l app=api-gateway Execute into the api-gateway pod (in case there are multiple replicas, you can enter any of the pods): kubectl exec -it -n sisense  $(kubectl get po -n sisense -l app=api-gateway -o name | tail -n 1) -- bash Note. If you use a non-default namespace, replace -n sisense with the correct namespace name. Use the following command to activate your license (replace email and password with your license credentials): curl ' http://localhost:8456/license/activate ' \  -H 'Content-Type: application/json' \  --data-raw '{"email":" your_license@sisense.com ","password":"pass"}'  Wait until all pods transition from Init:4/6 to Running state: kubectl get po -n sisense -w Conclusion You can activate a license in your Sisense installation by sending a request from within the API gateway container instead of a public web request. This method can be used to prevent access to the web application until the backup is restored in a new environment. Related Resources:    https://docs.sisense.com/main/SisenseLinux/activating-sisense-on-linux.htm   Disclaimer: This post outlines a potential custom workaround for a specific use case or provides instructions regarding a specific task. The solution may not work in all scenarios or Sisense versions, so we strongly recommend testing it in your environment before deployment. If you need further assistance with this please let us know.  

      Andrii Lohvin
      Andrii LohvinPosted 1 year ago
      0
               
      • TroubleshootingChevronRightIcon

      How to troubleshoot backup failures on Linux

                                       

      How to troubleshoot backup failures on Linux How to start a backup Sisense supports two options to initiate the creation of an application backup: Via Sisense SI cli command: https://docs.sisense.com/main/SisenseLinux/backing-up-and-restoring-sisense.htm   Via REST API: on-demand and scheduled backups . Any other ways to start a backup are not supported and may not work as intended. Considerations When running the SI commands, Sisense connects to the instance specified in the dns_application_name during the installation. If you create a clone of the environment, ensure this parameter points to the correct DNS of the clone instead of a production environment to avoid running commands in the wrong application. A backup with farms (Elasticube data) requires much more free space than a regular backup. Check the size of the /opt/sisense/storage/tenants/*/farms folders and the available space on the shared drive before running the backup command with farms. Based on the scale of your application, creating a backup may require considerable RAM resources. Consider scheduling backups when users’ activity in the application is low. Execution steps The execution of the source_add_completion.sh script requires the admin user credentials in the Sisense application. The Sisense web application must be reachable from the machine on which you execute this script (usually, one of the cluster machines or a bastion). You can validate whether Sisense received an incoming authentication request by tailing the API-gateway logs during the script execution: kubectl logs -n sisense -l app=api-gateway--tail=1 -f | grep "/api/v1/authentication/login" You should look for the following message: Finished handling request => POST /api/v1/authentication/login 200 If the request was not received, check DNS resolution, allowed outbound ports, security groups of your Load Balancer, etc. Once the user is authenticated, the subsequent SI commands will be proxied from the API gateway to the management pod. In case of a failure, you can review the logs of the management service to check for any errors during the execution: kubectl logs -n sisense -l app=management --tail=1 -f For example, when running an si system backup-list command to view available backups in the system, you will see the following logs: BE#587104 Finished handling POST request - url= https://test.sisense.com/api/v2/cli/execute BE#820886  cli command started ParsedCli(incompleteWord=null, incompleteArg=null, commands=[system, backup-list], args={}, options=[], payload=) BE#374860  cli command finishedParsedCli(incompleteWord=null, incompleteArg=null, commands=[system, backup-list], args={}, options=[], payload=) If the si system backup command was executed successfully, Sisense will create a sisense-restore-hash pod. You can use the following commands to locate the pod and trace its logs: kubectl get po -n sisense | grep backup sisense-backup-xlsw7                   1/1     Running     0              12s Ensure the status of the pod becomes Running. If the pod is stuck in the Pending state, use kubectl describe po -n sisense -l job-name=sisense-backup command to find out why the pod was not assigned to a cluster node yet. Pay attention to the events at the bottom of the output. Once the pod has entered the Running state, use the following command to view the logs of the backup: kubectl logs -n sisense -l job-name=sisense-backup --tail=-1 -f The last line in the sisense-backup logs indicates whether the backup creation was successful. If the task exited with a code other than 0, the backup creation has failed, and you can review the previous logs of the pod to identify the reason. An example of a successful execution should end with exited with code '0'.  The backup is created in the /opt/sisense/storage/system_backups folder. You can access the system_backups folder using the File Management feature: https://docs.sisense.com/main/SisenseLinux/uploading-files-to-customize-your-linux-deployment.htm . If you use a multi-node installation and would like to access the file from the server-side, the system_backups folder can be accessed by executing into the management pod. Retry attempts The created sisense-backup job is configured to retry the backup creation 6 times before failing. If the initial backup failed, you may see other pods with the sisense-backup-<hash> name in the Sisense namespace. Common failures 1. A_CUBE_IS_BUILDING ERROR: A cube is being build (A_CUBE_IS_BUILDING) This error may happen when you initiate a full backup (including farms) while there is an active Elasticube build in the system. You can stop the build and retry the backup attempt. 2. error mkdir ./kube: permission denied This error could occur in some Sisense versions when Sisense was installed with a non-default (other than 1000-id) user. Consider upgrading to the latest versions to address this issue. As a workaround in the current version, you can adjust the backup to run it as root: kubectl get job -n sisense sisense-backup -o json | jq 'del(.metadata.creationTimestamp)' | jq 'del(.spec.selector)' | jq 'del(.spec.template.metadata.labels)' | jq '.spec.template.spec.securityContext.runAsGroup = 0 | .spec.template.spec.securityContext.runAsUser = 0' | kubectl replace --force -f - 3. ENOSPC Error: ENOSPC: no space left on device, write The error indicates that the system ran out of disk space during the backup creation. You can do the following to reduce the disk space used:   - Consider creating a backup without farms. Elasticube data (farms) usually takes the most storage space. If you restore a backup without farms, you can then rebuild all your Elasticube models to pull Elasticube data directly from your data sources.   - Remove outdated images as described here: https://community.sisense.com/t5/knowledge-base/optimizing-docker-storage/ta-p/26340     - Review the Elasticubes on the Data page and remove models that are no longer in use.   - Check that logrotate runs without issues in the cluster: kubectl get po -n sisense | grep logrotate 4. Error: EACCES: permission denied, open '/opt/sisense/storage/translations/en-US/.navver.js.jbnEkp' This error may happen after an unexpected interruption in the file upload that created an unreadable file. The indications of such an occurrence are Extra filename path after the file format (.jbnEkp) The file is 0 bytes In such cases, you can delete this file and retry the backup creation. 5. Error getting usage [Error: ENOENT: no such file or directory, lstat '/opt/sisense/storage/usage/build/buildCustomTableStart/build-74877998b-xt69m-2023_01_29.csv'] The backup process might fail if the Usage Analytics Model elasticube is scheduled to build at the same time. Consider rescheduling the Usage Analytics elasticube build to another time frame. Conclusion This article provides a guide on troubleshooting backup failures in Sisense. It details the methods to initiate backups using the Sisense SI CLI command and REST API Related Resources   https://docs.sisense.com/main/SisenseLinux/backing-up-and-restoring-sisense.htm https://sisense.dev/guides/restApi/v2/?platform=linux&spec=L2023.11#/backups/startBackup https://sisense.dev/guides/restApi/v2/?platform=linux&spec=L2023.11#/backups/createBackupSchedule https://community.sisense.com/t5/knowledge-base/optimizing-docker-storage/ta-p/26340   Disclaimer: This post outlines a potential custom workaround for a specific use case or provides instructions regarding a specific task. The solution may not work in all scenarios or Sisense versions, so we strongly recommend testing it in your environment before deployment. If you need further assistance with this, please let us know.  

      Andrii Lohvin
      Andrii LohvinPosted 1 year ago
      0
               
      • TroubleshootingChevronRightIcon

      Error in ingress-nginx-controller pod after upgrading Sisense to L2024.1

                                               

      Error in ingress-nginx-controller pod after upgrading Sisense to L2024.1: main.go:64] port 80 is already in use. Please check the flag --http-port ! NOTE ! - this guide is relevant for non-cloud managed Sisense deployments i.e. installed with Sisense Kubernetes (RKE). After upgrading Sisense to version L2024.1 you might face the following error in ingress-nginx-controller pod’s logs (the default namespace): main.go:64] port 80 is already in use. Please check the flag --http-port Such an issue might be the result of incompatibility between the  ingress-Nginx release version that was updated in Sisense L2024.1 and the Kubernetes version in case it is lower than v1.26. In case Sisense L2024.1 was freshly installed on the non-cloud instance (i.e. with Sisense RKE) as a fresh deployment (and was not upgraded from the previous version) this issue should not reveal since L2024.1 package already comes with v1.26 Kubernetes by default. However, if Sisense was upgraded to L2024.1 or it was deployed/installed on Kubernetes lower than v1.26 there will be an incompatibility between the  ingress-Nginx release implemented in L2024.1 ( 4.10.0 ). To resolve the issue it is necessary to re-run the Sisense upgrade with the following parameters in the configuration yaml file: update: true update_k8s_version: true In case you are still facing the same issue after that, please open a ticket for Sisense Support. This article provides a brief explanation regarding possible Nginx<->Kubernetes compatibility issues in Sisense L2024.1. The article also provides the steps to resolve the issue described. Disclaimer: This post outlines a potential custom workaround for a specific use case or provides instructions regarding a specific task. The solution may not work in all scenarios or Sisense versions, so we strongly recommend testing it in your environment before deployment. If you need further assistance with this please let us know.

      Dmytro Popov
      Dmytro PopovPosted 1 year ago
      0
               
    • Blog banner
      • News & UpdatesChevronRightIcon

      Enhancing web security: A deep dive into single sign-on (SSO) and web access tokens (WAT)

                                               

      Single Sign-On (SSO) and Web Access Tokens (WAT) are two pivotal technologies in the domain of web security and user authentication. SSO simplifies the user experience by enabling access to multiple applications with a single set of login credentials, thereby enhancing both convenience and security. Conversely, WAT plays a crucial role in secure access management by granting temporary tokens that verify user identity and permissions across web applications. Both SSO and WAT are integral to creating a secure and seamless digital environment, each addressing unique facets of user authentication and access control. In the following sections, we will explore the mechanisms, benefits, and implementations of SSO and WAT. Understanding Single Sign-On (SSO) Single Sign-On (SSO) is a centralized authentication process that allows users to log in once and gain access to multiple applications without being prompted to log in again for each one. This technology is particularly beneficial in environments where users need to switch between different systems frequently. By reducing the number of login prompts, SSO not only enhances user convenience but also minimizes the risk of password fatigue and the associated security risks, such as password reuse or weak passwords. Moreover, SSO streamlines the management of user credentials, making it easier for administrators to enforce security policies and track access patterns. How SSO Works Single Sign-On (SSO) operates by establishing a trusted relationship between an identity provider (IdP) and multiple service providers (SPs). The IdP is responsible for authenticating the user's credentials, while the SPs are the various applications or services the user needs to access. This trusted relationship allows the user to authenticate once and gain access to multiple applications seamlessly. Step-by-Step Process: Initial Authentication: When a user attempts to access an application (SP), they are redirected to the identity provider (IdP) if they are not already authenticated. The IdP presents a login page where the user enters their credentials (e.g., username and password). Credential Verification: The IdP verifies the user's credentials. If the credentials are correct, the IdP generates an authentication token or ticket. This token contains information about the user and is securely signed to prevent tampering. Token Exchange: The authentication token is sent back to the user's browser, which then forwards it to the original application (SP) the user tried to access. The application verifies the token's validity by checking the IdP's signature. Access Granted: Once the token is verified, the user is granted access to the application without needing to enter their credentials again. The token can be used for subsequent requests to other SPs, enabling seamless access to multiple applications. Single Logout: SSO systems often include a single logout feature, where logging out from the IdP also logs the user out from all connected applications. This ensures that the user's session is securely terminated across all services. Underlying Technologies: SSO relies on several protocols and technologies to function effectively. Some common protocols include: SAML (Security Assertion Markup Language): A widely used standard for exchanging authentication and authorization data between an IdP and SPs. SAML uses XML-based messages to communicate assertions about user authentication and access rights. OAuth: An open standard for token-based authentication and authorization, commonly used for granting third-party applications limited access to user resources without exposing passwords. OpenID Connect: An authentication layer built on top of OAuth 2.0, allowing clients to verify the identity of users based on the authentication performed by an IdP and to obtain basic profile information. These protocols ensure secure and efficient communication between the IdP and SPs, enabling the seamless and secure exchange of authentication tokens. Security Measures: SSO systems implement several security measures to protect user credentials and authentication tokens: Encryption: Authentication tokens are encrypted to protect sensitive information during transmission. Digital Signatures: Tokens are digitally signed to prevent tampering and ensure their integrity. Multi-Factor Authentication (MFA): SSO can integrate MFA to add an extra layer of security, requiring users to provide additional verification (e.g., a code sent to their phone) beyond just a password. Session Management: SSO systems manage user sessions effectively, ensuring that tokens are valid only for a specific period and are renewed or revoked as needed. By combining these security measures and protocols, SSO systems provide a robust framework for managing user authentication across multiple applications, enhancing both security and user convenience. Pros and Cons of SSO Pros Cons Improved User Experience: Users only need to log in once to access multiple applications, reducing login fatigue. Simplifies the user experience by eliminating the need to remember multiple passwords. Enhanced Security: Centralized authentication allows for the implementation of stronger password policies. Easier to enforce multi-factor authentication (MFA) across all connected applications. Streamlined Administration: Simplifies user account management and access control. Easier to monitor and audit user access and behavior. Facilitates quick revocation of access when needed. Cost Efficiency: Reduces IT support costs related to password resets and account recovery. Saves time for users and administrators, improving overall productivity. Consistent User Policies: Ensures uniform security and access policies across multiple applications. Enhances compliance with regulatory requirements.   Single Point of Failure: If the SSO provider experiences downtime, users lose access to all connected applications. A compromised SSO account can potentially expose multiple applications to security risks. Complex Integration: Integrating SSO with existing applications can be technically challenging. Requires significant initial setup and configuration effort. Dependency on Third-Party Providers: Relying on external SSO providers can introduce risks related to service availability and data privacy. Potential for vendor lock-in if the SSO provider's technology becomes deeply integrated. Security Risks: Centralized authentication can make SSO systems attractive targets for attackers. Requires robust security measures to protect the SSO system itself. Scalability Issues: As the number of applications and users grows, the SSO system may face performance challenges. Ensuring consistent performance and availability can be complex. Useful Materials: Sisense SSO Documentation Sisense Composed SDK Authentication & Security Documentation Exploring Web Access Tokens (WAT) Web Access Tokens (WAT) are digital credentials used to authenticate and authorize users across web applications. Unlike traditional session management mechanisms, WATs provide a more scalable and secure method of handling user sessions. Typically, these tokens are used in stateless authentication systems, where the server does not maintain any session information. Instead, all necessary user information is encoded within the token itself, which the client includes in each request to access protected resources. How Web Access Tokens (WAT) Work Web Access Tokens (WAT), commonly implemented as JSON Web Tokens (JWT), are digital credentials used to authenticate and authorize users across web applications. Unlike traditional session-based authentication, WATs provide a stateless mechanism, meaning the server does not need to maintain session information. Instead, all necessary user information is encoded within the token itself, which the client includes in each request to access protected resources. Step-by-Step Process: User Authentication: When a user logs in to an application, they provide their credentials (e.g., username and password). The application sends these credentials to an authentication server for verification. Token Generation: Upon successful authentication, the authentication server generates a token, typically a JWT. This token contains encoded information about the user, such as their user ID, roles, and permissions. The token is digitally signed using a secret key or public/private key pair to ensure its integrity and authenticity. Token Storage: The generated token is sent back to the client (e.g., the user's browser or mobile app), where it is stored securely, often in local storage or a secure cookie. It's crucial to handle the token securely to prevent unauthorized access, such as through cross-site scripting (XSS) attacks. Token Usage: For subsequent requests to access protected resources, the client includes the token in the request header, typically in the Authorization header as a Bearer token. For example, the header might look like this: Authorization: Bearer <token>. Token Verification: When the server receives a request with a token, it verifies the token's signature to ensure it hasn't been tampered with. The server also checks the token's validity, including its expiration time and any other claims it contains. If the token is valid, the server processes the request and grants access to the requested resource. Token Expiration and Renewal: Tokens are usually issued with an expiration time to limit their validity period. Once a token expires, the user must re-authenticate to obtain a new token. Some systems use refresh tokens, which are long-lived tokens that can be used to obtain new access tokens without requiring the user to log in again. Security Measures: To ensure the security of WATs, several best practices are implemented: Encryption: Sensitive information within the token can be encrypted to protect user data. Signature Verification: Tokens are signed to ensure their integrity and authenticity. The server uses the same secret key (or public key in asymmetric encryption) to verify the token's signature. Secure Storage: Tokens should be stored securely on the client side, avoiding exposure to client-side scripts to prevent XSS attacks. Token Expiration: Tokens have an expiration time to limit the window of opportunity for misuse. Short-lived access tokens and long-lived refresh tokens balance security and user convenience. Scope and Audience Restrictions: Tokens can include claims that restrict their usage to specific scopes and audiences, enhancing security by ensuring tokens are used only as intended. By following these practices, WATs provide a scalable and secure method of managing user authentication and authorization across web applications, improving both performance and user experience. Pros and Cons of WAT Pros Cons Enhanced Security: Tokens are typically signed and can be encrypted, protecting against tampering and unauthorized access. Reduces the risk of session hijacking compared to traditional session management. Scalability: The stateless nature of tokens reduces server load and improves scalability. Servers do not need to maintain a session state, allowing for better performance under high load. Flexibility: Tokens can be used across different platforms, including mobile and single-page applications. Provides a consistent authentication mechanism for diverse environments. Fine-Grained Access Control: Tokens can contain detailed information about user permissions, enabling fine-grained access control and authorization. Allows for dynamic and context-sensitive access management. Decentralized Verification: Authentication and authorization can be performed without a centralized session store, enhancing reliability. Can easily integrate with microservices and distributed systems.   Token Management Challenges: Ensuring secure storage and handling of tokens on the client side is crucial to prevent token theft and misuse. Tokens stored in browser storage can be vulnerable to cross-site scripting (XSS) attacks. Expiration and Renewal: Tokens need to be regularly renewed to maintain security, adding complexity to session management. Handling token expiration and refresh workflows can be complex. Implementation Complexity: Implementing a token-based authentication system requires in-depth knowledge of security practices and protocols. Requires careful planning to ensure security and efficiency. Compatibility Issues: Ensuring that all applications and services can correctly handle and validate tokens can be challenging. Integration with legacy systems may require significant modifications. Performance Overhead: Token verification, especially with cryptographic signatures, adds computational overhead. It can impact performance if not managed properly, especially in high-load environments. Useful Materials: Sisense WAT Documentation Sisense Composed SDK Authentication & Security Documentation Integrating SSO and WAT Combining SSO and WAT can provide a comprehensive authentication and authorization solution. SSO can handle the initial authentication process, while WATs can manage user sessions and permissions across different applications. This integration allows organizations to leverage the strengths of both technologies, providing a seamless and secure user experience. In the next sections, we will explore real-world examples, best practices, and implementation strategies for integrating SSO and WAT in web applications. About Paldi Solutions is a trusted Sisense Gold Partner, specializing in advanced plugins, customized solutions, reporting automation, and embedded analytics enhancements. As a leading Sisense partner, we serve over 160 Sisense clients with enterprise-ready solutions designed for reliability and seamless performance. Our OEM-friendly plugins integrate effortlessly, ensuring scalability and long-term stability. With deep technical expertise and a commitment to innovation, we empower businesses to maximize their BI potential with powerful, user-friendly tools. Discover how Paldi Solutions can elevate your Sisense experience at  www.paldi.solutions  

      Benjamin Nissim
      Benjamin NissimPosted 1 year ago
      0
               
      • Cloud Managed ServiceChevronRightIcon

      Creating and deleting EKS cluster in the existing VPC

                                               

      Creating and deleting EKS cluster in the existing VPC Introduction: This guide demonstrates how to create an Amazon EKS (Elastic Kubernetes Service) cluster within existing VPCs and subnets, and how to remove it using the same configuration file with a single command. It’s not a recommendation but just an example of the working solution and you have to adjust it according to your needs. Step-by-Step Guide: 1. Prerequisites If you haven’t connected to your AWS account yet, you need to configure it. You can either create a dedicated Linux bastion or use your local laptop. VPC Requirements : Ensure that there is a VPC with both public and private subnets in each of the three availability zones of your chosen region. Each node group must use only one availability zone. AWS CLI Installation : Depending on your operating system (bastion or laptop), install the appropriate version of the AWS CLI (Linux / MacOS / Windows). For installation instructions, visit: AWS CLI Installation . AWS Credentials Configuration : Configure your AWS credentials using one of the available methods. For guidance, refer to: AWS CLI Configuration . Install eksctl : Install the eksctl command-line tool. For installation instructions, visit: eksctl Installation . 2. Setting up cluster.yaml file The configuration below is valid and was tested with eksctl version 0.193.0. Replace the values in metadata.name, region, and the public and private subnet IDs with your own, and save it as cluster.yaml. As for the ‘version’ please refer to the Kubernetes Compatibility Matrix https://docs.sisense.com/main/SisenseLinux/linux-minimum-requirements.htm     apiVersion: eksctl.io/v1alpha5 kind: ClusterConfig metadata: name: cluster-test region: us-east-2 version: "1.30" vpc: nat: gateway: Enable subnets: private: us-east-2a: id: subnet-022d3d9104ab651b4 us-east-2b: id: subnet-0b1c2ac0216e101c2 us-east-2c: id: subnet-09c84f9835a0ae13f public: us-east-2a: id: subnet-0fab7bc831ca7a25a us-east-2b: id: subnet-062966c1571fcef50 us-east-2c: id: subnet-08f3dbb5e5fae4b20 managedNodeGroups: - name: query-a labels: node-sisense-Application: "true" node-sisense-Query: "true" iam: withAddonPolicies: autoScaler: true awsLoadBalancerController: true certManager: true ebs: true efs: true fsx: true instanceType: m5a.2xlarge desiredCapacity: 1 minSize: 1 maxSize: 2 volumeSize: 300 availabilityZones: ["us-east-2a"] - name: query-b labels: node-sisense-Application: "true" node-sisense-Query: "true" iam: withAddonPolicies: autoScaler: true awsLoadBalancerController: true certManager: true ebs: true efs: true fsx: true instanceType: m5a.2xlarge desiredCapacity: 1 minSize: 1 maxSize: 2 volumeSize: 300 availabilityZones: ["us-east-2b"] - name: build labels: node-sisense-Build: "true" iam: withAddonPolicies: autoScaler: true awsLoadBalancerController: true certManager: true ebs: true efs: true fsx: true instanceType: m5a.2xlarge desiredCapacity: 1 minSize: 1 maxSize: 2 volumeSize: 300 availabilityZones: ["us-east-2c"]     Explanation of YAML Parameters apiVersion : Specifies the version of the eksctl API being used. This is important for compatibility with the features and configurations available in that version. kind : Defines the type of resource being created. In this case, it is a ClusterConfig , which indicates that the configuration is for an EKS cluster. metadata : Contains metadata about the cluster. name : The name of the EKS cluster. This should be unique within the region. region : The AWS region where the cluster will be created (e.g., us-east-2 ). version : The Kubernetes version to be used for the cluster (e.g., "1.30" ). vpc : Configuration related to the Virtual Private Cloud (VPC) where the EKS cluster will be deployed. gateway : Indicates whether to enable a NAT gateway for the cluster. Setting it to Enable allows private subnets to access the internet. private : Lists the private subnets by availability zone, each identified by its subnet ID. public : Lists the public subnets by availability zone, each identified by its subnet ID. nat : Configuration for Network Address Translation (NAT) gateways. subnets : Defines the subnets to be used for the cluster. managedNodeGroups : Configuration for the managed node groups that will run the workloads in the EKS cluster. Each node group can have its own settings. withAddonPolicies : Specifies which AWS services and features the node group should have permissions for, such as: autoScaler : Enables the Kubernetes Cluster Autoscaler. awsLoadBalancerController : Grants permissions for the AWS Load Balancer Controller. certManager : Grants permissions for managing SSL/TLS certificates. ebs : Grants permissions for Amazon Elastic Block Store. efs : Grants permissions for Amazon Elastic File System. fsx : Grants permissions for Amazon FSx. name : The name of the node group. labels : Key-value pairs used to organize and select the nodes in the group. iam : IAM role and policies associated with the node group. instanceType : The EC2 instance type to be used for the nodes (e.g., m5a.2xlarge ). desiredCapacity : The desired number of nodes in the node group. minSize : The minimum number of nodes in the node group. maxSize : The maximum number of nodes in the node group. volumeSize : The size of the EBS volume (in GiB) attached to each node. availabilityZones : Specifies the availability zones where the nodes in the group will be deployed. After setting up file you  can create a cluster with the  eksctl create cluster -f cluster.yaml command Obtain the kubernetes configuration by running the following command: aws eks update-kubeconfig --region us-east-2 --name cluster-test A shared storage (FSX) must be created manually     aws fsx create-file-system --file-system-type LUSTRE --storage-capacity 1200 --tags Key="Name",Value="cluster_test" --subnet-ids "subnet-0b1c2ac0216e101c2" --lustre-configuration "DeploymentType=PERSISTENT_1,PerUnitStorageThroughput=100"     --file-system-type LUSTRE  - only this type is supported by Sisense --storage-capacity 1200  -  the minimal 1200 GB storage for FSX Lustre --tags - update the name and other tags needed --subnet-ids "..." - one of the subnets of your VPC --lustre-configuration - according to the parameters supported https://docs.aws.amazon.com/fsx/latest/LustreGuide/using-fsx-lustre.html Conclusion: A summary of key takeaways or final points. The steps above should help you prepare an EKS cluster for the SIsense installation.   The cluster can be deleted with the single command: eksctl delete cluster -f cluster.yaml --disable-nodegroup-eviction References/Related Content: Links and resources for further reading. https://docs.sisense.com/main/SisenseLinux/linux-minimum-requirements.htm https://docs.sisense.com/main/SisenseLinux/autoscaling-and-linux.htm https://docs.sisense.com/main/SisenseLinux/deploying-sisense-on-amazon-eks.htm https://eksctl.io/usage/creating-and-managing-clusters/ https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html https://eksctl.io/installation/ https://docs.aws.amazon.com/fsx/latest/LustreGuide/using-fsx-lustre.html

      Oleg Valynkin
      Oleg ValynkinPosted 1 year ago
      0
               
    • Blog banner
      • News & UpdatesChevronRightIcon

      TreviPay’s Best Practice Journey

                                               

      TreviPay’s Best Practice Journey TreviPay introduced Sisense internally in 2017, shortly after they began constructing a data warehouse. At that time the data warehouse team was composed of a Database Engineer, Principal Architect, and Data Engineers who were also responsible for creating ElastiCubes and building data models in Sisense among many other things. When Sisense was initially introduced the primary focus was to help the financial team consolidate information for financial reporting.  Then, there was a company drive to expand reporting for Customer Support and Client Accounts Receivable teams, and now nearly every internal department at TreviPay and many of our clientele access content in Sisense. Let me shift gears and provide a bit more context into our setup so the remainder of the story makes sense. TreviPay uses the Sisense on-prem solution. We are, and have always been, a single node cluster with two environments, development (dev) and production (prod). Our development environment connects to an instance of our data warehouse that is an exact replica of production with some limiters in place. We set up the replica environment to allow better testing and one-off ad-hoc support in our lower Sisense environment. Now, back to the beginning, as demand for data grew and the designer count expanded things quickly spiraled out of control. Designers were only building content in production, designers using the same datasets would get vastly different results, and content was being shared with anyone who had access without any kind of review. Yikes. Fast forward to 2021 where TreviPay formally introduces a Data & Analytics (D&A) team into the organization. Now there is a Data and Analytics manager, data engineers, architects, and analysts on the team with a Product Manager to guide them. However, the damage has already been done. This team is now faced with rebuilding the reputation of data integrity in the data warehouse. The rebuild is set in motion. This was obviously going to be a multi-step process. The first step was to determine how this newly founded D&A team was going to operate. The team set a path to consistently source and manage stakeholder requests and outlined a development process using agile methodology and tools. Next, designers throughout the organization needed to be trained on best practices for building and distributing content. This focused heavily on driving designers to start building in the development environment instead of going straight into production and following a few simple design guidelines. For this, the D&A team put together training documentation using SharePoint for best practices they wanted other designers to follow. Then, there needed to be consolidation and clean-up of fields available in multiple data sets within each model.  One of the most difficult challenges to overcome was helping designers understand the structure of the data models since they could not see them without higher licensing privileges. The D&A team chose to reconstruct a visual of the model using excel to depict the joins. After that came the clean-up of old or unused dashboards in production. Using the REST APIs, we pulled together reports on dashboards including when they were last accessed, who owns them, who they are shared with, and which ElastiCube(s) they are using. We established a base set of rules to identify dashboards we wanted to eliminate and began purging. The dashboards that remained were then divvied up by the owner or owning department. The desired outcome of this step was to eliminate any duplicative dashboards and review everything for accuracy. As you can imagine, this was a very long process.  The team worked with the dashboard owners to understand the purpose behind each of their remaining dashboards and determine whether they were still relevant. Each remaining dashboard underwent testing and review by the D&A team to ensure the dashboard was reporting the proper data as the designer had intended. Fast forward to the end of 2024 when I am writing this blog, the D&A team has only grown by one individual throughout this time and process, adding another analyst to the team. Trust in the data available from the data warehouse has been restored and the team is operating more efficiently than ever. The D&A team has become the centralized reporting hub streamlining dashboards and reporting while supporting other analysts in their development and data questions. What seemed a daunting task has been achieved and TreviPay is better off for it.

      cmdaniels
      cmdanielsPosted 1 year ago
      0
               
      • Product Feedback ForumChevronRightIcon
      Means to tag dashboards to enable search
                       
      zebben
      zebbenPosted 1 year ago • Last reply 1 year ago
               
      5
               
      • TroubleshootingChevronRightIcon

      Error on installation "cp: cannot create regular file '/usr/local/bin/kubectl': Text file busy"

                                       

      The error "cp: cannot create regular file '/usr/local/bin/kubectl': Text file busy" typically occurs when multiple upgrade processes are running simultaneously, causing a conflict when trying to update the kubectl binary.     [2024-10-30 12:33:34] Getting binaries kubectl (v1.30.3) and helm (v3.12.3) [2024-10-30 12:33:34] Downloading them from the internet % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 138 100 138 0 0 1367 0 --:--:-- --:--:-- --:--:-- 1380 100 49.0M 100 49.0M 0 0 3478k 0 0:00:14 0:00:14 --:--:-- 3525k % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 15.2M 100 15.2M 0 0 3730k 0 0:00:04 0:00:04 --:--:-- 3731k linux-amd64/helm cp: cannot create regular file '/usr/local/bin/kubectl': Text file busy [2024-10-30 12:33:53] ** Error occurred during command sudo cp installer/05_post_infra/files/kubectl installer/05_post_infra/files/helm /usr/local/bin section ** [2024-10-30 12:33:53] ** Exiting Installation ... **   For example, in one case, the error occurred because multiple upgrades were happening on the same environment simultaneously (the same bastion for several cloud environments), which led to the Kubectl binary being in use by another upgrade process. The recommended solution is to check if any process is using Kubectl or Helm before proceeding with the upgrade. Watching an upgrade with "kubectl ... -w" command can cause this issue also. To prevent this error, it is advisable to: Ensure that no other upgrade or deployment processes are running in parallel. Use commands like lsof -t $(which kubectl) and lsof -t $(which helm) to check if these binaries are in use. If any command returns a PID, print out the process details using ps -ef | grep <pid number> and fail the pipeline if necessary. By following these steps, you can avoid the "Text file busy" error and ensure a smooth upgrade process. Related Content: https://academy.sisense.com/sisense-administration https://docs.sisense.com/main/SisenseLinux/upgrading-sisense.htm  

      Oleg Valynkin
      Oleg ValynkinPosted 1 year ago
      0