Skip to main content
Announcements
Qlik Community Office Hours, March 20th. Former Talend Community users, ask your questions live. SIGN UP
cancel
Showing results for 
Search instead for 
Did you mean: 
Not applicable

Need help with Section Access in Sense Server

Hi All...

I am struggling to implement Section Access in Qlik Sense Server. I've tried a couple of times but got locked out of the file both the times. This is the first time I am trying to implement Section Access in Sense, earlier i've done it once in QlikView and I was trying to use the same logic, maybe I am missing something.

What I am trying to achieve is:

We have Salesperson say Abc and when Mr. Abc will login to Sense he should only be able to see the Customers under him. SalesPerson and CustomerName are under the same table in the data model.

The script I am trying is something like this(Since I am locked out again, i cant access the exact script)

Section Access;

Load * Inline

[

Access, UserID

User, ADMINISTRATOR

];

Load * Inline

[

UserID, SALESPERSON

ADMINISTRATOR, ABC

];

Section Application;

In the load editor, i have converted SalesPerson to Upper(). What i want is when Mr Abc logs in via UserID ADMINISTRATOR he should only be able to see the customers under him.

I've read most of the blogs but unable to solve this. Any hints or guidance will be greatly appreciated.

9 Replies
Miguel_Angel_Baeyens

Hi Muntazir,

Section access works with a single table, that can be fed from different sources.

So in your case:

SECTION ACCESS;

LOAD * INLINE [

ACCESS, USERID, SALESPERSON

USER, DOMAIN\ADMINISTRATOR, ABC

];

SECTION APPLICATION;

USERID must be in the form DIRECTORY\USER the same way it is in the QMC and recognized by the Proxy service, for example, INTERNAL\SA_SERVICE

Much more info here https://help.qlik.com/sense/en-us/online/#../Subsystems/Hub/Content/Scripting/Security/ManagingSecur...

Miguel

Colin-Albert

There is a good document on Section Access here    http://community.qlik.com/docs/DOC-1853

First always create a copy of your app without section access - as you have discovered, incorrectly applying section access can lock you out of your app!

The field names and data for section access must be UPPERCASE.

Your section access table for testing should be something like this.
For live use, you should use NTNAME instead of UserID and Password.

Section Access;

Load * Inline

[

ACCESS, USERID,                PASSWORD, SALESPERSON

ADMIN,     ADMIN,                     123,           *

USER,      ADMINISTRATOR,   234,           ABC

USER,      USER2,                     345,           DEF

USER,      USER3,                     456,           EFG

];

Section Application;

Remember that * in Section Access only refers to values listed in the Section Access table, not all values in your data.

So if you have a SALESPERSON XYZ in the data (not listed in the section access table above) then the ADMIN user cannot access this data!

Not applicable
Author

Hi Miguel,

Appreciate your prompt response. Ill try what you mentioned. I just have a question, incase you could take a min to answer them if possible:

1. In QlikView I  implemented Section Access but i used two tables, one for authentication which authenticated the user with a userid and password and in the second table i performed the authentication(since there were two columns on which reduction was required). And it worked very well in QlikView. So is it that we can have two tables linked in Section Access in QlikView but the same is not possible in Sense ?

Warm Regards,

Muntazir Syed

Not applicable
Author

Thanks for your response Colin. I have gone through the document and indeed it is helpful. I have heard that in Qlik Sense there is no Admin under Access, could you please confirm if what i know is right ?

Colin-Albert

Both ADMIN  and USER as shown in the section access help for Sense.

There are more details on Data Reduction in Sense here

https://help.qlik.com/sense/en-US/online/index.html#../Subsystems/Hub/Content/Scripting/Security/Dyn...

Miguel_Angel_Baeyens

Colin,

ADMIN was not working as of 1.0.2 and is a known bug, bot sure if it is fixed in 1.1. Share if you used it and it worked, that means it is fixed!

Do not use ADMIN in section access or you will be locked out.

Miguel

Miguel_Angel_Baeyens

Muntazir,

Yes, you can use two tables or more to get your security in place, however, the SECTION ACCESS ... SECTION APPLICATION only allows ONE table. If you are loading more than one, those must be joined in some way.

After section application statement yo do can use more tables to refine permissions at a field, row or group level.

By the way, you can specify as many columns as you want in the same section access table, you need not to create more tables if you just want to control several reduction fields in section access.

Miguel

P.S.: See working example here:

2 section access ?

Not applicable
Author

Appreciate your response Colin. The document mentions only USER under ACCESS and Admin is under USERID. Anyways i guess i should use NTNAME like you mentioned rather than USERID. My only doubt is the values under NTNAME will have to be exactly like the usernames in Active Directory, with the complete path, right ?

Colin-Albert

Thanks for clarifying the issue with ADMIN Miguel.  I have not yet tested this on 1.1