Section Access: Strict Exclusion

    The strict exclusion feature often causes confusion and misunderstanding. The main purpose is to protect user access, due to  incorrectly setup section access reduction. A good start to understanding the feature it is good to first recap on the basic reduction logic of Section Access.

     

    In its simplest form a Section Access can be defined as below. The logic for reduction is that the reduction values are applied as selections, and the possible data after the selection is the reduced data provided to the user.

    1.png

    In this example Anna the admin gets access to all the data through the reduction values A and B. Mary the user only gets access to value A. But what is the expected outcome for Erica the user?

     

    Erica has a reduction value that does not exist in the data. The expected reduction result is the same as if you select the value C.

     

    1. Open the search box in list box
      2.png
    2. Enter the non-existing value
      3.png
    3. Hit enter to apply the search
      4.png
    4. The value can not be select and all previous values remain as possible values

     

    From this little test we can draw the conclusion that the expected result for a non-existing reduction value is that you get all the possible values in the field. In other words the reduction has no impact, and when Erica logs in she gets access to all the data.

    5.png

    The Strict Exclusion function can be enabled in Document Properties. With this enabled reduction on non-existing values is not allowed.

    6.png

    This means that Erica has no valid reduction values in the reduction field and is denied access to the application.

    7.png

    If Erica has at least one valid reduction value the reduction will always match on the existing value(s) only. There is no risk for getting all values or being locked out by strict exclusion. Do a search for valid and invalid values in a list box as reference, for example search for A or C as below and A will be the found and selected value.

    8.png

     

    IMPORTANT: With strict exclusion enabled you can easily lock yourself out of the QlikView application. Always reload with a user that has valid reduction values, otherwise you will not be able to access the document after reloading.