topic Re: Reduction field in section access in QlikView

Reduction field in section access

NickP_DF — Fri, 30 Jul 2021 16:35:56 GMT

Hi guys,

I'd like that a user shouldn't be able to see the S or T order types (the other users must see everything), so that I create a section access like that:

Section Access;
LOAD * INLINE [
ACCESS, USERID, PASSWORD, ID, ACCESSORDERTYPE
ADMIN, ADMIN, xxx, 0,
ADMIN, BOB, yyy, 1,
ADMIN, JOHN, aaa, 1
USER, MIKE, hhh, 2, S
USER, PAUL, zzz, 2,
USER, LAURA, ttt, 2
];

Section Application;

AccessGroups:

LOAD * INLINE [

ID, GROUP
0, ADMINISTRATORS
1, PRODUCTION
2, FABRIC
];

In this way, it works properly for the users ADMIN, BOB, JOHN (who see everything), the user MIKE sees only "S" order type and the users PAUL and LAURA get the error "The document...failed to load" 🙄

Besides that, If I add a line to above the MIKE user to avoid him to see the S and the T order types:

...

USER, MIKE, hhh, 2, S
USER, MIKE, hhh, 2, T

...

it works properly for the users ADMIN, BOB, JOHN (who see everything, like in the previous version), and the users MIKE, PAUL and LAURA get the error "The document...failed to load."

What's wrong with my script?

Thank you so much.

Re: Reduction field in section access

Or — Fri, 30 Jul 2021 18:02:23 GMT

For starters, your script doesn't actually give PAUL and LAURA any permissions because you left ACCESSORDERTYPE null. You should be using * for "Everything" (excluding nulls, but you should generally avoid the use of section access on fields with nulls), which may also require a * is star statement.

Since you are using multiple fields for your section access, it'd be best to start with this:

https://community.qlik.com/t5/Qlik-Design-Blog/Basics-for-complex-authorization/ba-p/1465872

Re: Reduction field in section access

NickP_DF — Sat, 31 Jul 2021 07:38:09 GMT

Hi,

thank you for your answer 🙂

I've read your reply and the documentation you suggested and I've changed my script as:

Section Access;
LOAD * INLINE [
ACCESS, USERID, PASSWORD, ID, ACCESSORDERTYPE
ADMIN, ADMIN, xxx, 0,
ADMIN, BOB, yyy, 1,
ADMIN, JOHN, aaa, 1,
USER, MIKE, hhh, 2, S
USER, MIKE, hhh, 2, T
USER, LAURA, ttt, 2, *
];

Section Application;

AccessGroups:

LOAD * INLINE [

ID, GROUP
0, ADMINISTRATORS
1, PRODUCTION
2, FABRIC
];

The results are:
- the ADMIN users account log in and see all the order types, as I wish
- MIKE user logs in, but he can see only the 'S' order types (not also the 'T' as I wish)
- LAURA user logs in, but he can see only the 'S' order types (not ALL the order types as I wish)

Pls. note that LAURA behavior is what I expected since I've read in the documentation that the "*" grants all the reduction listed in section access, but I'd like her to be allowed to all the order types (from 'A' to 'Z')

Thanks.

Re: Reduction field in section access

NickP_DF — Tue, 03 Aug 2021 19:50:39 GMT

....So I've made a step ahead and now I'm able to allow multiple values to MIKE

Section Access;
LOAD * INLINE [
ACCESS, USERID, PASSWORD, ID, TIPOORDINELIM
ADMIN, ADMIN, xxx, 0,
ADMIN, BOB, yyy, 1,
ADMIN, JOHN, aaa, 1
USER, MIKE, hhh, 2, LIMITATO
USER, LAURA, ttt, 2, ALL
];

Section Application;

AccessGroups:

LOAD * INLINE [

ID, GRUPPO
0, ADMINISTRATORS
1, PRODUCTION
2, FABRIC
];

OrderTypeLimitations:

LOAD * INLINE [

TIPOORDINELIM, TipoOrdVendita
LIMITATO, S
LIMITATO, T
];

The results are:
- the ADMIN users account log in and see all the order types, as I wish
- MIKE user logs in, and he can see only the 'S' and the 'T' order types, as I wish

I'm not able to allow LAURA to see ALL the order types as I wish: I wouldn't like to list in the OrderTypeLimitations table all the rows:
ALL, A
ALL, B
ALL, C

...

ALL, Z

because if they'll implement a new Order Type in the future (such as '$', for example), LAURA won't be able to see it without my intervention in the section access code).

Thank for the help.

Re: Reduction field in section access

hic — Fri, 03 Sep 2021 07:27:14 GMT

Yes, it is possible. One way to do it is along the following lines:

Section Access;
LOAD * INLINE [
ACCESS, USERID, PASSWORD, ID, TIPOORDINELIM
ADMIN, ADMIN, xxx, 0, <ALL>
ADMIN, BOB, yyy, 1, <ALL>
ADMIN, JOHN, aaa, 1, <ALL>
USER, MIKE, hhh, 2, LIMITATO
USER, LAURA, ttt, 2, <ALL>
];

Section Application;
OrderTypeLimitations:
Load distinct
'<ALL>' as TIPOORDINELIM,
TipoOrdVendita
Resident OrderLineTable;

Concatenate (OrderTypeLimitations)
LOAD * INLINE [
TIPOORDINELIM, TipoOrdVendita
LIMITATO, S
LIMITATO, T
];

This assumes that all values of "TipoOrdVendita" exist in the "OrderLineTable".

Good luck!

HIC

Re: Reduction field in section access

NickP_DF — Fri, 10 Sep 2021 17:19:15 GMT

Thank you Henric for your solution!