Situation

When customers use embedded analytics, their users will often need multiple embed user IDs to access different data sets with different permissions. An example would be when a person works with different companies, so they need different sets of permissions to access each company’s data.

You can do this by giving a person several external user IDs, each with the right permissions for a particular data set. For example, if you had multiple doctors who each worked with several practices (companies), the `external_user_id`s could be:

DrZhang@app.com/Practice-A

DrZhang@app.com/Practice-B

DrGray@app.com/Practice-B

DrGray@app.com/Practice-C

Picking a Naming Convention for Tracking Usage

By default, each user ID is treated as a unique user. If you want to track a specific person's total usage, you’ll want a way to merge the usage for all of their IDs. An easy solution is to use a consistent naming convention for the `external_user_id` script parameter.

In the example above, the naming convention is actual-end-user-identifier/some-additional-context-needed-for-session-permission, where actual-end-user-identifier can be the person's email address and some-additional-context-needed-for-session-permission helps determine the permissions and what data this user ID should have access to.

This pattern identifies each unique person at the beginning. Now you can create an i__looker query with a custom dimension that returns the part of the ID that uniquely identifies the person. For example, DrGray@app.com/ uniquely identifies Dr Gray’s two user IDs. To get the ids grouped together, we needed to strip off anything after the / in `embed_user.external_user_id`.

Querying Usage

Querying by the custom dimension instead of the full external user ID will merge all of the person’s usage. In the example above, Dr. Gray’s two external user IDs will be grouped together as “DrGray@app.com/”. 

From here you can audit usage by person, without counting a person multiple times. In the link below, replace hostname with your Looker hostname and run this query:

https://hostname.looker.com/explore/i__looker/user?fields=user.first_name,user.last_name,just_email&f[user.is_disabled]=No&f[user.is_looker]=No&f[role.embed]=Yes&sorts=just_email+desc&limit=500&query_timezone=Europe%2FLondon&vis=%7B%7D&filter_config=%7B%22user.is_disabled%22%3A%5B%7B%22type%22%3A%22is%22%2C%22values%22%3A%5B%7B%22constant%22%3A%22No%22%7D%2C%7B%7D%5D%2C%22id%22%3A0%2C%22error%22%3Afalse%7D%5D%2C%22user.is_looker%22%3A%5B%7B%22type%22%3A%22is%22%2C%22values%22%3A%5B%7B%22constant%22%3A%22No%22%7D%2C%7B%7D%5D%2C%22id%22%3A1%2C%22error%22%3Afalse%7D%5D%2C%22role.embed%22%3A%5B%7B%22type%22%3A%22is%22%2C%22values%22%3A%5B%7B%22constant%22%3A%22Yes%22%7D%2C%7B%7D%5D%2C%22id%22%3A2%2C%22error%22%3Afalse%7D%5D%7D&dynamic_fields=%5B%7B%22dimension%22%3A%22just_email%22%2C%22label%22%3A%22Just+Email%22%2C%22expression%22%3A%22substring%28%24%7Bembed_user.external_user_id%7D%2C+0%2C+position%28%24%7Bembed_user.external_user_id%7D%2C+%5C%22%2F%5C%22%29%29%22%2C%22value_format%22%3Anull%2C%22value_format_name%22%3Anull%2C%22_kind_hint%22%3A%22dimension%22%2C%22_type_hint%22%3A%22string%22%7D%5D

If your account representative requests an audit, you can create this query and schedule it to be sent to them. Alternatively, you can allow Looker to authenticate in to your instance, then your account representative can create and run the query.

Additional contributor: Jesus Cruz-Cervantes