article Section Access: Strict Exclusion in Official Support Articles

Section Access: Strict Exclusion

ToniKautto — Wed, 30 Nov 2022 10:09:36 GMT

The strict exclusion feature often causes confusion and misunderstanding. The main purpose is to protect user access, due to incorrectly set up section access reduction. A good start to understanding the feature it is good to first recap on the basic reduction logic of Section Access.

In its simplest form, a Section Access can be defined as below. The logic for reduction is that the reduction values are applied as selections, and the possible data after the selection is the reduced data provided to the user.

In this example Anna the admin gets access to all the data through the reduction values A and B. Mary the user only gets access to value A. But what is the expected outcome for Erica the user?

Erica has a reduction value that does not exist in the data. The expected reduction result is the same as if you select the value C.

Open the search box in list box
Enter the non-existing value
Hit enter to apply the search
The value can not be select and all previous values remain as possible values

From this little test we can draw the conclusion that the expected result for a non-existing reduction value is that you get all the possible values in the field. In other words the reduction has no impact, and when Erica logs in she gets access to all the data.

In QlikView, the Strict Exclusion function can be enabled in Document Properties. With this enabled reduction on non-existing values is not allowed.

Note that in Qlik Sense Strict Exclusion is always ON. See Adapting the data load script in Qlik Sense.

This means that Erica has no valid reduction values in the reduction field and is denied access to the application.

If Erica has at least one valid reduction value the reduction will always match on the existing value(s) only. There is no risk for getting all values or being locked out by strict exclusion. Do a search for valid and invalid values in a list box as reference, for example search for A or C as below and A will be the found and selected value.

IMPORTANT: With strict exclusion enabled you can easily lock yourself out of the QlikView application. Always reload with a user that has valid reduction values, otherwise you will not be able to access the document after reloading.

Re: Section Access: Strict Exclusion

kkkumar82 — Wed, 27 May 2015 12:06:42 GMT

Hi what is the use of the option "Initial selection based on Section Access" in comparison with "Initial Data Reduction based on Section Access ".

Kiran

Re: Section Access: Strict Exclusion

ToniKautto — Wed, 27 May 2015 12:10:48 GMT

Initial data reduction will reduce the application data based on the user reduction values.

Initial selection will select the reduction values, and not reduce the data.

Re: Section Access: Strict Exclusion

kkkumar82 — Wed, 27 May 2015 12:17:46 GMT

You mean to say that for "initial section .." the values in the reduction field will be get selected but the whole data will be present but where as for "initial data reduction.." only the associated rows of the reduction field values will be loaded.

If so please create a qvw file comparing these two things, because there are sample qvws in the forum.

Thanks

Kiran Kumar

Re: Section Access: Strict Exclusion

ToniKautto — Wed, 27 May 2015 12:23:18 GMT

Correct. "Selection" means the values get selected, "Reduction" means the data is reduced.

I do not have the intention to create a sample on that right now. It is fairly easy to try, so just take the sample in this page, and change the setting yourself. Login to the app as MARY or ERICA to see reduced data.

Re: Section Access: Strict Exclusion

Karim_Khan — Fri, 06 Nov 2015 14:38:22 GMT

Very Nice Post

Re: Section Access: Strict Exclusion

NareshGuntur — Tue, 17 Nov 2015 14:30:29 GMT

Very easy and simple to understand.

Thanks Toni

Re: Section Access: Strict Exclusion

Mon, 25 Jul 2016 21:23:27 GMT

Toni, we implemented the SA with "Strict Exclusion". I can able to access the qvw on desktop client but I got access denied error on Access point ?

Re: Section Access: Strict Exclusion

amezzaro — Wed, 15 Feb 2017 14:54:55 GMT

Hi. we too implemented the SA with "Strict Exclusion". We can able to access the qvw on desktop client but we got access denied error on Access point.

Re: Section Access: Strict Exclusion

ToniKautto — Wed, 15 Feb 2017 22:39:07 GMT

The reason for this is that the service account has not been granted access to all your data, leaving the user with a larger reduction than anticipated. See Section Access: Desktop vs Server‌‌ as reference

Re: Section Access: Strict Exclusion

ToniKautto — Wed, 15 Feb 2017 22:39:19 GMT

Re: Section Access: Strict Exclusion

amezzaro — Thu, 16 Feb 2017 09:45:39 GMT

Correct.Thank you very much. We were aware of this, and we usually add a line in the SectionAccess with empty values for the Qlik Service identity :

Section Access:

USER_ACCESS:

SQL

SELECT [ users from database ]

Concatenate /* administrative access and qlik service hard coded*/

LOAD * INLINE [

NTNAME , ACCESS, A , B, C

'NTNAME_QVUSER' , 'ADMIN' , , ,

'NTNAME_ADMINUSER1' , 'ADMIN' , , ,

'NTNAME_ADMINUSER2' , 'ADMIN' , , ,

This way it works, normally.

In this very last case, we occasionally add wrong rows with specific values for the QVUSER

from the database and at the end the USER_ACCESS table had multiple values for the

QV User:

USER_ACCESS

NTNAME , ACCESS, A , B, C

'NTNAME_QVUSER' , 'ADMIN' , , ,

'NTNAME_USER1' , 'ADMIN' , XX ,YY , ZZ

'NTNAME_USER2' , 'ADMIN' , XX ,YY , ZZ

'NTNAME_QVUSER' , 'ADMIN' , XX , YY ,ZZ

This is not working, of course...

Re: Section Access: Strict Exclusion

ToniKautto — Thu, 16 Feb 2017 21:33:58 GMT

Try adding a * as reduction value for service user. This will give the user access to all values represented in the section access table.

Re: Section Access: Strict Exclusion

amezzaro — Fri, 17 Feb 2017 11:36:17 GMT

Thanks again,Toni. '*' or nothing '' it seems the same, indeed, from a QV Admin perspective in the Secton Access table,as far as I experienced.

Another issue we met with strict exclusion is that one user could be excluded if he has NO entry AT ALL in one of the Section Application tables. So, it's better to move any meaningless bridge table outside of the Section Application if it is not granted that every user has an entry on it.

Re: Section Access: Strict Exclusion

krishnacbe — Wed, 13 Dec 2017 15:06:52 GMT

Thanks for the Post. Clear and simple example.

Re: Section Access: Strict Exclusion

omerfaruk — Thu, 17 May 2018 10:02:34 GMT

Thanks for the post.

One addition, if you use * instead of leaving empty for the restricted field in the section access table, you should append all possible values to your section access table otherwise, admin or users having full access will only have access to all "listed" values rather than all "possible" values.

Re: Section Access: Strict Exclusion

ToniKautto — Wed, 19 Sep 2018 10:55:24 GMT

Wildcard reduction value behaves the same ways regardless if you have strict exclusion or not.

I would suggest that you post a question in community, and describe a section access scenario that you want to accomplish. It is often easier to discuss best options around a specific solution, rather than discussing general capabilities.

Introduction to Section Access‌ is a bit dated by still covers the basics of section access in QlikView.

Re: Section Access: Strict Exclusion

thomas_wang — Wed, 19 Sep 2018 11:12:18 GMT

I'm sorry that what I said might cause misunderstanding to you and others. Meanwhile, I would like you to confirm this discussion: Re: Section Access "Star"