topic Access denied with Section Access in Management & Governance

Access denied with Section Access

Federicofkt — Fri, 17 May 2024 12:00:46 GMT

Hi, I'm new to Section Access and I have some problem. That's my code:

Section Access;
LOAD * inline [
ACCESS, USER.EMAIL
ADMIN, mail@mail.com
USER, mail2@mail.com
]
;
Section Application;

where the ADMIN user it's me and the email is 100% correct. The problem is that when I reload the app, it says that I have access denied after the reload. I don't understand what I'm doing wrong here.

Update:

I've added the REDUCTION column (as written in the documentation) with the variable on which I wanted to filter the accesses, like so:

Section Access;
LOAD * inline [
ACCESS, USER.EMAIL, KEY_AREAMANAGER
ADMIN, mymail@mail.com, *
USER, mail2@mail.com, X
]
;

with the purpose of letting me see everything and USER see only data related to variable X.

Since then, the disaster: the script gave an "unknown error" after the reload and now neither I and the other user can access the app.

How do we solve this? We are both admin and owner of the space and the app, how is it possible that we cannot access? Did we just lost everything?

Re: Access denied with Section Access

BrunPierre — Fri, 17 May 2024 10:42:14 GMT

Using a domain name or group name necessitates the use of NTNAME.

Section Access;
LOAD * inline [
ACCESS, NTNAME
ADMIN, mail@mail.com
USER, mail2@mail.com
]
;
Section Application;

Re: Access denied with Section Access

Lech_Miszkiewicz — Fri, 17 May 2024 10:39:29 GMT

Hi @Federicofkt

What are we talking about here?

Is it:

QlikVIew?
Qlik Sense Enterprise on Windows (QSEoW On Premise)?
Qlik Sense SaaS?

Indeed if you are using QlikView you may need to use NTNAME as @BrunPierre suggests, if it is QSEoW then you may need to use USERID etc.

Make sure you use UPPER CASE for your user email.

https://help.qlik.com/en-US/cloud-services/Subsystems/Hub/Content/Sense_Hub/Scripting/Security/manage-security-with-section-access.htm

Re: Access denied with Section Access

Federicofkt — Fri, 17 May 2024 11:58:03 GMT

Qlik CLoud, so Qlik Sense Saas.

The think is that now I've added the REDUCTION column (as written in the documentation) with the variable on which I wanted to filter the accesses. I've tried with my user and another one, the script gave an "unknown error" after the reload and now neither I and the other user can access the app.

What's going on here?

Re: Access denied with Section Access

henrikalmen — Fri, 17 May 2024 12:10:35 GMT

What do you mean by "can not access the app"? Are you saying that no admin can open the app's script for editing and therefore you can not make changes to the section access part of the script?

Re: Access denied with Section Access

Federicofkt — Fri, 17 May 2024 12:28:14 GMT

I mean that when someone tries to open the app, this message appears:

That in english means Error, Access denied, and the details there is code error 5.

So yes, it seems like that nobody can access the script in order to make changes in the access part of it

Re: Access denied with Section Access

henrikalmen — Fri, 17 May 2024 12:36:43 GMT

Does that happen to all admins as well, not just regular users? Do you have some kind of service account included in the section access that you could use to access the app?

Re: Access denied with Section Access

Federicofkt — Fri, 17 May 2024 13:04:28 GMT

Both me and the other colleague of mine have admin acces, and we can't access the app.

I've actually solved by exporting it and then reimporting, somehow I'm able to open the imported one. But still I don't understand what happened in the original app.

Re: Access denied with Section Access

Lech_Miszkiewicz — Fri, 17 May 2024 13:05:34 GMT

Use „open without data”, update your script, and make sure everything in section access is in UPPER CASE!!!

Re: Access denied with Section Access

Federicofkt — Fri, 17 May 2024 13:08:16 GMT

So the email addresses as well?

Re: Access denied with Section Access

Federicofkt — Fri, 17 May 2024 13:13:56 GMT

I've put everything in upper case but I'm back to the previous situation where I try to load the data, no error but a message of be careful that I'll have the accesses denied.

my script is like so:
Section Access;
LOAD * inline [
ACCESS, USER.EMAIL, KEY_AREAMANAGER
ADMIN, MYMAIL@MAIL.COM, *
USER, USERMAIL@MAIL.COM, X
]
;

The emails are correct

Re: Access denied with Section Access

Lech_Miszkiewicz — Fri, 17 May 2024 13:41:14 GMT

Yes. Everything!

now, when using * in your section access are you:

using declaration: Star is *:
having all required values in your section access reduction field (note that * will only populate those which are present in section access so if you have only X your * will only link with X
try using explicit link or create linking table within section access to make sure that part works as your issue may be related to * (wildcard) not working

i suggest you run section access script without section access statement to see if tables link properly!
see how it goes

Re: Access denied with Section Access

Federicofkt — Fri, 17 May 2024 14:34:30 GMT

Still same warning.

I tried without the section access statement and the table is correctly linked.

In the KEY_AREAMANAGER (reduction) column I have 3 values, X, Y and ND, I'd like to try to let myself see everything and the other user see only X related values.

I still don't understand what's wrong now

Re: Access denied with Section Access

Lech_Miszkiewicz — Fri, 17 May 2024 14:51:36 GMT

When you use =OsUser() function in UI does it return your email?

i am just wondering if maybe you are using Qlik IDP and instead you need to use USERID

Re: Access denied with Section Access

Federicofkt — Fri, 17 May 2024 15:01:04 GMT

That's the output of =OsUser():

UserDirectory=AZURE; UserId=mymail@mail.com

I've tried with replacing USER.EMAIL with USERID, keeping the email adresses, still same warning