Automation in updating section access sheet

[onkarkulkarni]

Hello All,

I have a dashboard where I am displaying count of user per Country, Product type and category. I have applied section access to restrict access for Country, Product type and category.

Now user request access for particular country and product through mail, then I update the section access file (.xlsx) on the server.

On daily basis it is becoming too hectic to monitor and update the excel sheet , high chances of missing user details in mail chains.

Could you please suggest an approach to avoid manual intervention. It would be great if backend section access file gets updated automatically based on the user inputs through a well defined process.

Hope I am clear with my requirements and thanks in advances.

Regards,

Onkar kulkarni

[ToniKautto]

To me it sounds like you already might have groups in directory that could allow automating this by applying groups in section access. For example I would guess there are groups to send emails to all employees within a region, so that you do not have to customize groups just for this app.

[onkarkulkarni]

unforunatley we dont have such groups . This is brand new application and we have started working from scratch. That is the reason I am looking for long term and robust approach to handle this requirement.

[ToniKautto]

This has nothing to do with Qlik or the specific app. I am referring to existing attributes and groups in your companies directory service, which you can utilize within Qlik Sense to govern user access.

What I am suggesting is that you look in to what attributes and groups you have available in your existing identity provider and directory service.

[onkarkulkarni]

Thanks Toni..

I will explore possible options to utilise exisitng groups.I am bit afraid that exisiting groups will not provide all the required infomation.

e.g In exisitng AD groups user will have his region and country mentioned . However if user is from India and he requires access for singapore and India, then it will be manual intervention again or creating new groups

[rittermd]

We have a similar situation.  It really depends on where you data is coming from.

If it is purely manual entry then you are kind of stuck doing what you are doing.  If the data is coming from another source then you might be able to automate it.  We currently do that with WorkDay data. 

There is not always a quick and simple solution with Section Access.  Your options are really dependent on where the data is sourced and what you are trying to do with it.

[Digvijay_Singh]

I think you need one web page 'request for access' to all those who makes decision for access, the details somehow needs to be stored in section access SQL/(any database) table to be read as it is being done through Excel.

[onkarkulkarni]

Thanks Mark,

Data is provided by users manually. So I believe it has to be handled manually as we are doing it right now.

There is no fix data source.

[onkarkulkarni]

Thanks Digvijay,

yeah.. It was the first option that came into my mind. However I see couple of challenges in it

1. We dont have dedicated java server in our project

2. Our audit team will rasie concern on the security of this webpage since it will be accessible for everyone.

3. we need to maintain login logs on this web page else anyone can update access request for others.

Regards,

Onkar

[ToniKautto]

My advice is keep it simple and be smart. Utilize resource that you already have, to minimize maintenance.

A custom webpage sounds like a complicated solution, compared to Excel file where user access is controlled by normal file access rights. Especially since custom solutions require maintenance. What is really the difference with adding rows in a DB compared to an excel sheet?

User access should not be driven by the users deciding what to see. Access should be attribute based. Users should have attributes like department, city, country, role etc attached to them in a directory of some sort, and them get access to information based on their attributes.

If you dont have a directory available, have you considered using a free/open solution that would allow you to manage users and there attributes? Could Apache Directory‌ be an option?

You them simply extract and utilize these directory attributes to drive user access in Qlik Sense, either in security rules or Section Access.

[onkarkulkarni]

Thanks Toni,

I will definitly check the Apache directory option.