Strict Exclusion is not working on QEMC

[#1]

Hello, We added the section access with strict exclusion. The logic is working fine on the Qlikview Desktop client. But when we deployed to Staging server the strict exclusion is not working. We got "Failed to Open a Document Access denied".

Is these any server settings needs to be update ?

Any one faced this type error before

[danieloberbilli]

I am facing the same problem. But in my case I don't have any limited fields/values and only wanted to enable admins to have access but not the users...so it is not a problem to turn off 'strict exclusion'. I thought the reason for the denied access could be the situation that there were no corresponding fields in section access in section application

See the manual:

"...access to the document will be denied whenever the field values in

the section access reduction fields lack matches in their corresponding section

application field."

But would be interested to know if there is another reason.

[crusader_]

Hi,

I've faced the same problem in documents with SA. Even though we do not use Initial Data reduction in some of them.

We've resolve this issue by ticking off "Strict exclusion checkbox" even it seems to be disabled (not active).

Hope this helps.

Regards,

Andrei

[Peter_Cammaert]

You're probably mixing two things here:

• ADMIN access in the Desktop: in QlikView Desktop, SA entries with ACCESS=ADMIN will always be able to get in, whatever the link values, data reduction results, strict exclusion setting, etc. This is a behavior that is Desktop-only. Probably configured this way to allow developers to debug...document security.
• Strict exclusion: in the Access Point, everybody is a USER, even the IDs that have ACCESS=ADMIN. Since most ADMINS have an empty link field (for example the service account responsible for reloading the document should best be configured with an empty link field.)  Strict exclusion will always deny them access because there is no data left after reduction.

Peter

[#5]

Peter, if the user have both his reduction value & null, it denied ?

[Bill_Britt]

Hi,

You need to make sure the service account is in SA and has ADMIN rights.

Bill

[#7]

Britt, I am using our staging server service account in SA and that have full Admin privileges on the staging server.

Is there any idea why other user accounr got "Failed to open the document Access Denied" error.

[Bill_Britt]

Hi,

Take a look at the attached qvw. If you try to login as user D you will get the error and it is because he has no data assigned to him.

Section Access;
LOAD * INLINE [
    ACCESS, USERID, DATA
    ADMIN, A, *
    USER, B, 1
    USER, C, 2
    USER, D,
];
Section Application;

LOAD * INLINE [
    DATA, YEAR
    1, 2015
    2, 2014
    3, 2013
];

[#9]

Britt, The example you provided looks fine. In my case the developers (testing) can access the qvw with desktop client. But we can't access the qvw on Access point.

LOAD * INLINE [

NTNAME , ACCESS, REDUCTIONFIELD

DOMAIN\SQLIKVIEW , ADMIN , <ALL>

DOMAIN\USER1 , USER , A

DOMAIN\USER2 , USER , B

DOMAIN\USER3 , USER , C

];

LOAD * INLINE [

REDUCTIONFIELD , FIELD

<ALL> , A

<ALL> , B

<ALL> , C

A, A

B,B

C,C

];

The above is the exiting SA & reduction table on environment. The reduction works fine on Desktop Client. But it won't work on the Access point.

[Peter_Cammaert]

Did you let the server reload your document before opening it in the AccessPoint?

Peter