Default user in Section Access

[#1]

Hi,

Is it possible to define a default user in Section access?

What I'm trying to accomplish is that a number of named users (NTNAME) should see a sheet that is hidden for everyone else without having to specify it for every NTNAME. So if a user isn't named in Section access he or she should get a default access level.

Thanks

🙂 Fredrik

[#2]

Hi Gordon.

Thanks for your quick answer. I agree with you on not letting default be ADMIN, however, that doesn't solve the problem. Let me examplify with some code:

star is *;
SECTION ACCESS;

AccessControl:
load * inline
[NTNAME, ACCESS, ID
MR_BROWN, USER, SE
*, USER, US
];

SECTION APPLICATION;

UserDetails:
Load ID
resident AccessControl;

Country:
Load * inline
[ID, Country
SE, Sweden
US, USA
UK, United Kingdom
];

I want Mr Brown only to see Sweden. But running the above script, Mr Brown will in fact see both Sweden and the US. With other words, he picks up the access rights both from the row where he is explicitely named and from the default user row. It doesn't seem like qlikview breaks off at the first positive match but rather reads the whole table and grants all applicable rights.

So how do I get my explicitly named users to be excluded from the default user settings?

Cheers,
David

[kji]

Use OTHERSYMBOL instead of *.

SET OTHERSYMBOL=+;

and replace your * with a + for the default user.

[#4]

Hi John,

Thanks for your answer. I still can't get it to work though. With the following code, only MR_BROWN will be able to open the application, i.e. the othersymbol = + doesn't work as a wildcard for the default user.

Section ACCESS;

SET OTHERSYMBOL = +;

AccessControl:
load * inline
[NTNAME, ACCESS, ID
MR_BROWN, USER, SE
+, USER, US
];

What am I doing wrong?

/David

[nathanfurby]

I am experiencing the same problem.

The 'OtherSymbol' approach does not work as David has already mentioned.

The 'Star is *;' approach does work but only when the user's NTNAME is not already specified in the table - once again pointed out by David and also the original problem from Fredrik.

Fredrik - what was the typo that you found?

Gordon - you mentioned the Section Access works on a top-down basis but this seems incorrect - am I experiencing a bug? (QV 9 SR4)

Thanks for any help offered.

[nathanfurby]

Quick Update:

I have now noticed that the problem only occurs when the same 'Access' value is used. In the following example the qlikview NT Name will work as planned but the nathan NT Name will be linked to both the HIGH and LOW groups and therefore on load no default selection is made. Change the nathan ACCESS Level to 'ADMIN' and the user will only be linked to the HIGH group.

Section Access;
Access01:
LOAD * INLINE [
ACCESS, NTNAME, SYSGROUP
ADMIN, qlikview, HIGH
USER, nathan, HIGH
USER, *, LOW
];

Section Application;
Application01:
LOAD * INLINE [
SYSGROUP
HIGH
MEDIUM
LOW
];

[#7]

Hello,

Don't remeber exactly what the typo was but I think it was only a miss spelling.

Having tested this a bit more I have come to the same conclusion as Nathan.

Cheers/ Fredrik

[nathanfurby]

Thanks Fredrik - will pass this on to support to see if they think this is a bug.

[#9]

I have looked for confirmation of what I believe(d) is the 'top down' authentication but cannot find proof. I think it might have been in a Qliktech scripting course but I actually threw the course notes away recently after years of gathering dust.

I have never encountered the specific circumstances we are talking about here but I am sure I didnt dream it!

Regards,

Gordon

[nathanfurby]

I hope you don't have any dreams about QlikView Gordon

What you say makes sense and also is proven correct in the scenario I mentioned where the Access Level is ADMIN for the user but USER for the '*' (Rest of them) Group - the 'search' stops there. I can't believe that the scenario I detailed has not been noticed before. If it is a bug it must mean that QV users don't make use of Section Access in this way - can't believe that either.

Will see qht QlikTech say. Thanks,.

[Miguel_Angel_Baeyens]

Hello,

I see one thing here: "*" in section access doesn't mean "all values for field" but "all listed values" for that field, meaning that in the following example:

STAR IS *;
SECTION ACCESS;
LOAD * INLINE [
ACCESS, USERID, PASSWORD, COUNTRY
ADMIN, ADMIN, ADMIN, *
USER, USER1, USER1, BE
USER, USER2, USER2, ES
USER, USER3, USER3, UK
];
SECTION APPLICATION;
Countries:
LOAD * INLINE [
COUNTRY, Name
UK, United Kingdom
BE, Belgium
DE, Germany
ES, Spain
US, United States
FR, France
];

ADMIN won't see all countries, but those listed in the section access: BE, ES, UK regardless being ADMIN. Instead,

ADMIN, ADMIN, ADMIN,

(note the null value for the COUNTRY field) will see any value from that field.

Hope shed some light.

EDIT: Corrected the COUNTRY field name in the Countries table.