Issues with Section Access in QS 2.2

[vlad_komarov]

Hi all,

I've noticed strange application's behaviour when Section Access is activated. 

I do have a data set that contains multiple "Districts"

Here is the full list with no Section Access:

I've added the following code:

section access;

LOAD * inline [

ACCESS, USERID,REDUCTION, OMIT

ADMIN, SERVER\JOSEPH.AAAAAA,*,

ADMIN, SERVER\VLADIMIR.KOMAROV,*,

ADMIN, INTERNAL\SA_SCHEDULER,*,

USER, SERVER\SAM.BBBBBB,CANADA,

USER, SERVER\SAM.BBBBBB,FLORIDA,

USER, SERVER\ALEX.CCCCCCCC, CHICAGO,

USER, SERVER\NATE.DDDDDDD,SAN FRANCISCO

USER, SERVER\NATE.DDDDDDD,NEW ENGLAND,

];

section application;

......

// District

District__:

Load Distinct

"_st_site_id" AS [Site Id],

[Tag Type] AS [District],

upper([Tag Type]) AS REDUCTION

RESIDENT Tag_Data

WHERE [Tag Value] LIKE 'District'

;

Which produced the proper data reduction:

The problem is that the ADMIN account that suppose to display ALL districts:

ADMIN, SERVER\VLADIMIR.KOMAROV,*,

Is displaying only districts that are listed under other REDUCTION section for other users!!

My account with Section Access enabled:

All other districts that suppose to be visible are simply missing!

I have to load ALL districts explicitly into Section Access code for them to be displayed...

I've noticed this behavior in 2.1.1 release and the latest upgrade (2.2.3) did not change much...

I would appreciate any comments/suggestions/....

Best regards,

Vladimir 

[Gysbert_Wassenaar]

The problem is that the ADMIN account that suppose to display ALL districts:

ADMIN, SERVER\VLADIMIR.KOMAROV,*,

Is displaying only districts that are listed under other REDUCTION section for other users!!

Yes, that's what * means: all listed values. If you want all values instead of all listed values the leave it blank. This has not changed. It's been implemented this way for ages in Qlikview and works just the same in Qlik Sense. This is documented in the online help:

A wildcard, *, is interpreted as all (listed) values of this field, that is. a value listed elsewhere in this table. If used in one of the system fields (USERID, GROUP) in a table loaded in the access section of the script, it is interpreted as all (also not listed) possible values of this field.

[vlad_komarov]

Gysbert,

Thank you for reply. I've replaced the wildcard with the blank and it works for ADMIN account...

But, do you know why "blank" field does not work for USER level account?

I've updated the code above as:

USER, SERVER\ALEX.CCCCCCCC, ,

And I've got the "Access Denied" message when trying to log-in to the application....

The app was published to the stream and this user has access to it.

Making this user an ADMIN works...

BTW, I did interpreter the help topic differently:

"( wildcard, *) If used in one of the system fields (USERID, GROUP) in a table loaded in the access section of the script, it is interpreted as all (also not listed) possible values of this field."

So my understanding was that all (also not listed) values should be displayed .....

I cannot check the QlikView files at this moment, but I will try to get to my old files to validate it in QV.

Regards,

Vladimir

[Gysbert_Wassenaar]

If you want to give a user with USER level access to all values, listed or not, then you can do two things afaik.

1. create entries for all values for that user

2. add a line STAR is *; to the script before creating the section access table and use * for that user instead of leaving the field blank.

[vlad_komarov]

Gysbert,

I ended up adding all entries for a dummy user and concatenate it with the main SA table.

Adding a "STAR is *;" statement did not change much...

Thank you for your help.

Regards,

Vladimir

[rbecher]

STAR (*) worked for Users also on v2.1.1, w/o "listing" all entries before. I think this is just a bug..