​

Intro

• Access the Toolkit
• Required grants
• Configuration DataSet
• Create a job
• Run a job
• Example job run
• Use dynamic policies
• Use dynamic PDP with custom attributes
• Use multiple Filters on a single policy
• Remote instance configuration
  • Configure PDP automation for remote instance
  • Configure Domo access token account
  • Generate access token

​

Access the Toolkit

1. In the navigation header, select More > Admin.
2. In the Governance menu, select Toolkit.
   Note: If the Toolkit option does not display in the Governance menu, make sure your user role has the required grants. You may need to enable the Toolkit by reaching out to your Account Executive.

​

Required Grants

• Create Custom Pipeline Processes
  • This grant will allow a user to create, update, share, and delete jobs.
  • This grant will only allow a user to see jobs that they created or jobs that have been shared with them.
• Administer Custom Pipeline Processes
  • This Grant will allow a user to create, update, share, and delete jobs.
  • this grant will allow a user to see all jobs

​

Configuration DataSet

• target_ds
  • This is the DataSet id that the PDP policy should be applied to
  • In a configuration DataSet you can have multiple DataSet ids
• policy_name
  • The name of what the policy is called on the target_ds
  • If a policy with that name does not exist a new policy will be created with this name
• policy_column
  • The column name that contains the values you wish to filter by
• user_group
  • User ID or emails
  • Group ID or name
  • These are the users or groups you wish to have access to the PDP policy
  • This supports multiple values. Different values should be separated by a pipe ‘|’
• value
  • Values to filter the policy by
  • This supports multiple values. Different values should be separated by a pipe ‘|’
• custom_filter
  • The custom filter type to be applied
  • The filter options include: greater_than, greater_than_equal, less_than, less_than_equal, between, and begins_with.
  • Multiple values can be set using the same filter with |
  • When using between, the two values must be separated by ’&’. For example: 04012020 & 04022020 | 04032020 & 04042020
    
    

    ​

​

Create a Job

1. Navigate to the Governance Toolkit and select PDP Automation.
   • https://example.domo.com/admin/governance-toolkit/pdp-automation
2. Click + New Job at the top right.
3. Fill out the following information:
   • Job Name (required)
   • Job Description (optional)
   • Configuration DataSet (required)
     • This is the DataSet that defines what policies you wish to update or create.
   • Orphaned policy management (required)
     • Orphaned policies refer to existing PDP policies on your DataSet defined in your configuration DataSet, but policies that are not being updated in your configuration DataSet.
     • Keep
       • Will leave those existing policies in place with no changes.
     • Delete
       • Will delete those policies that exist on the DataSet but not in the configuration file.
   • Run Logs (required)
     • Each job will keep track of executions of the job and information surrounding that.
     • New DataSet
       • Will create a new DataSet in your Domo instance and all runs of the job will write logging to the new DataSet.
     • Existing DataSet
       • Existing DataSet will allow you to combine multiple PDP Automation jobs into a single logging DataSet.
       • The DataSet must be a DataSet created by the PDP Automation tool.
         • DataSet must also already contain rows of data.
     • Email notifications (optional)
       • You can add user emails to this field.
       • Each email will receive an email notification from Domo each time the job runs.
       • The notification will outline what the job did during the run and any failures that occurred.

​

Run a Job

• Preview Only
  • The job will only execute when the job is manually run.
  • When the job is run it will not update the actual target DataSet(s) from your configuration file. It will update the log DataSet with all the changes it would have made to the DataSet.
    • This allows you to validate the job before it updates your DataSets.
• Active
  • This will update the PDP policies on your DataSet(s).
  • The job will execute every six hours.
  • The job will execute every time the configuration DataSet is updated.

​

Example Job Run

• PDP Before run:
  
• Configuration DataSet:
  
• PDP after run:
  
• Logging DataSet:
  

​

Use All Rows Policy

1. In the Details view for the DataSet for which you want to extend the All Rows policy, select Edit Webform. The webform for the DataSet displays.
2. In the user_group field of the All Rows policy row, add the email addresses for your user(s) or group(s), using a pipe | as a delimiter.
3. Select Save and Continue. The user or group is now added to the All Rows policy.

​

Use Dynamic Policies

​

List of Trusted Attributes

​

Use Dynamic PDP with Custom Attributes

• The attribute must be set to “managed.” Learn about attribute management.
• In the configuration file, the content in the Value column must be the attribute key.

​

Use Multiple Filters on a Single Policy

​

Remote Instance Configuration

​

Configure PDP Automation for Remote Instance

1. While creating or editing a job for PDP Automation, in the Configuration section, select a configuration DataSet populated with valid values for the remote instance according to PDP Automation guidelines given in this article. See Configuration DataSet.
2. Still in the Configuration section, choose Remote Instance for where to run the job. The Instance Settings display.
3. In the Instance: field, enter the domain for the remote instance you want to manage PDP for.
4. From the Select the account for your instance: list, select a valid Domo Access Token account. To learn how to configure a Domo Access Token account, see the next section.
5. Fill in the details for the Reporting section.
   Note: The notification emails and metric logs are written to the instance the policy is running from, not to the remote instance.
6. Select Submit to save your changes to the job.

​

Configure Domo Access Token Account

1. In the Domo navigation header, select Data. The Data Center opens.
2. In the sidebar, select Accounts.
3. Select Add New > Account. The Add Account modal displays.
   
4. In the modal, complete one of the following options:
   • Access Token — Enter an access token in the Remote Instance Access Token field. To learn how to generate a token, see Generate Access Token.
   • Username and password — Enter your credentials in the Remote Instance Username and Remote Instance Password fields.
5. Select Connect.

​

Generate Access Token

1. In the Domo navigation header, select More > Admin. The Admin Settings display.
2. In the Authentication menu of the Admin Settings, select Access tokens.
3. On the Access tokens page, select + Generate access token.
   
4. Enter a description in the Access token description field.
5. Search for and select a user for whom you are generating the access token.
6. Select an expiration interval in the Expire after list.
7. Select Generate.
8. Copy the code to use.