Strict Exclusion is not working on QEMC

[#1]

Hello, We added the section access with strict exclusion. The logic is working fine on the Qlikview Desktop client. But when we deployed to Staging server the strict exclusion is not working. We got "Failed to Open a Document Access denied".

Is these any server settings needs to be update ?

Any one faced this type error before

[#2]

Peter, Yer we refreshed the report & we tried both Server Distribute & Folder Distribute.

[Bill_Britt]

Hi,

In looking at your example I have a few questions? What is your service account name? Is it SQLIKVIEW? If so you need to remove the <ALL> from the REDUCTIONFIELD field. That will allow it to reload all data.  If you are trying to make it were a users can see values A,B & C use a * in the field and don't do the <all> stuff.

Yours load

LOAD * INLINE [

NTNAME , ACCESS, REDUCTIONFIELD

DOMAIN\SQLIKVIEW , ADMIN , <ALL>

DOMAIN\USER1 , USER , A

DOMAIN\USER2 , USER , B

DOMAIN\USER3 , USER , C

];

LOAD * INLINE [

REDUCTIONFIELD , FIELD

<ALL> , A

<ALL> , B

<ALL> , C

A, A

B,B

C,C

];

Try this

LOAD * INLINE [

NTNAME , ACCESS, REDUCTIONFIELD

DOMAIN\SERVICEACCOUNT , ADMIN ,

DDOMAIN\SOMEUSERNAME, ADMIN,*

DOMAIN\USER1 , USER , A

DOMAIN\USER2 , USER , B

DOMAIN\USER3 , USER , C

];

LOAD * INLINE [

REDUCTIONFIELD , FIELD

A, A

B,B

C,C

];

[#4]

Britt, SQLIKVIEW is service account and this account access to ALL Reduction field values. so I added the custom value instead of <ALL>. This approach was mentioned ny Henric in his section access blog spot.

[#5]

Britt, As you suggested the below SA table works fine with Strict Exclusion. Why "<ALL>" to Service account is not working on the Access point but it works fine on Desktop client ? Is there any specific reason with AJAX client.

LOAD * INLINE [

NTNAME , ACCESS, REDUCTIONFIELD

DOMAIN\SERVICEACCOUNT , ADMIN , *

DDOMAIN\SOMEUSERNAME, ADMIN,*

DOMAIN\USER1 , USER , A

DOMAIN\USER2 , USER , B

DOMAIN\USER3 , USER , C

];

LOAD * INLINE [

REDUCTIONFIELD , FIELD

A, A

B,B

C,C

];

I have another question, if we are doing Distribute to Qlikview server to Specific mounted folder, we seen duplicate qvw files on access point ?

[Bill_Britt]

Hi,

For a user the  <ALL> might work, never have used that before. On the second issue, I would think you mount folder is under the root folder. If that is the case QVS will see the document in the mount folder when it scans the root.

This is wrong and you will see the document in the Mount folder twice.

This would be a correct way.

Bill

[ToniKautto]

As far as I can tell strict exclusion is not the main reason for your problems. Strict exclusion in this case actual protects you from showing all data to the users.

The reload and distribution sequence on server will be inline with;

1. Open and reload QVW
2. Close and save temp QVW with all data|
   
3. Reopen the temp QVW as the service user
4. Data in reduced based on service user reduction values
   
5. Save QVW in source documents
6. Distribute QVW

When User1 with reduction value A tries to open the application from the Access Point the distributed application does not have a matching reduction value.
With Strict Exclusion enabled this means that the user gets access denied do no no matching data.
With Strict Exclusion disabled a user with no matching data will get access to all data.

In desktop client the QVW is always stored with all data, and the reduced when user opens the file.

I hope this clarifies why you get the observed difference between server and desktop client.