topic Re: SECTION ACCESS with NTNAME in QlikView

SECTION ACCESS with NTNAME

datanibbler — Fri, 22 May 2015 07:52:16 GMT

Hi,

I want to implement SECTION ACCESS in my app with NTNAME so no one has to enter a username and password.

I want to add myself as ADMIN and everyone else as USER.

I guess this won't work with the *. I don't want to try because it might then register myself as USER and effectively lock me out.

Can anybody help here?

Thanks a lot!

Best regards,

DataNibbler

Re: SECTION ACCESS with NTNAME

marcus_sommer — Fri, 22 May 2015 08:03:46 GMT

Hi DataNibbler,

at first make one/two BACKUP's !!! and yes you need to include all NTNAME's especially the development- and server-user with ADMIN role (per access point are all users only USER). A wildcard won't work.

Section Access

- Marcus

Re: SECTION ACCESS with NTNAME

datanibbler — Fri, 22 May 2015 08:15:36 GMT

Hi Marcus,

I thought so. Well, that's too bad. The idea behind this was, there will be a number of users - and they might even change over time as we have quite a high personnel fluctuation in some areas. I would like to make this as robust as possible so there won't be any need to regularly adapt it.

The users will need the client because one of the core functions is reloading the script - but I actually don't want the users to be able to do much else, that is the only reason why they'd need the Client - maybe I should instead look at using EDX_triggers and macros to let them use the app via the AccessPoint. I'm just not sure whether that will work reliably because one user might have to reload (part of) the script quite often.

Re: SECTION ACCESS with NTNAME

awhitfield — Fri, 22 May 2015 08:47:03 GMT

HI DataNibbler,

we have a similar situation to you, have a look at the attached.

1. Open lockdown qvw and the user has restricted access no doc properties or edit script etc, but has reload and save.

2. close the qvw and qv desktop

3. open unlockdown with user name and password BATMAN for both

4. reopen lockdown and you now have access to all!

Lockdown has hidden script, password = BATMAN as follows:

Section Access;

LOAD * INLINE [

ACCESS, USERID, PASSWORD, NTNAME, NTDOMAINSID

ADMIN, BATMAN, BATMAN, *, *

USER, *, *, *, *

];

Section Application;

and security tab as:

unlock down has the script

section access;
LOAD * INLINE [
ACCESS, USERID, PASSWORD
ADMIN, BATMAN, BATMAN
];

section Application

Re: SECTION ACCESS with NTNAME

datanibbler — Fri, 22 May 2015 08:56:17 GMT

Hi Andrew,

that is a novel approach. I'll give it a think, that might be a solution.

Just to recap so you can tell if I got it right:

So you have created two different qvw files where the one (the lockdown one) automatically opens with USER privileges, so nobody

can mess around in it.

There is another one which I can open with Admin privileges if I need to make any changes.

=> Afterwards, I can make a copy of it and use that to overwrite the old lockdown app.

Is that it?

Thanks a lot!

Best regards,

DataNibbler

Re: SECTION ACCESS with NTNAME

awhitfield — Fri, 22 May 2015 09:03:15 GMT

Unlock down forces the lockdown to open in the context of the BATMAN admin user, so you can edit etc, it's as simple as that, we have been using it successfully in the filed for 4 years now

Andy

Re: SECTION ACCESS with NTNAME

marcus_sommer — Fri, 22 May 2015 09:05:23 GMT

Hi DataNibbler,

for me is these case quite easy then I use DMS as authentication mode with a custom directory and need not to use personalized NT user. I could use functionalized NT user which are only connected to area, region and similar - complete independent which person they use. If a person left the company I don't need to do anything - only if they switch the position inside the company I need to change the password for these user but only within the qmc not in section access.

I won't recommend DMS - it has disadvantages, too. But maybe you could adapt the logic with additionally functionalized users. It's not perfect because the users need two logins but it could be an alternatively.

- Marcus

Re: SECTION ACCESS with NTNAME

datanibbler — Fri, 22 May 2015 09:15:54 GMT

That is just great.

I'll test that on my database_app and if it works, that is definitely one worth inserting into our "development_guide", our collection of internal standards.

You should make that into a document or something if you haven't already done so. That's definitely one every developer should know about.

Re: SECTION ACCESS with NTNAME

datanibbler — Fri, 22 May 2015 09:27:26 GMT

Seems to work.

Great!

Re: SECTION ACCESS with NTNAME

awhitfield — Fri, 22 May 2015 09:30:34 GMT

Excellent stuff! Glad it did the trick for you!

Have a good one!!

Andy

Re: SECTION ACCESS with NTNAME

datanibbler — Fri, 22 May 2015 11:05:28 GMT

Hi,

I guess the underlying "trick" behind that is that the passwords must be identical - QlikView probably stores the password in some internal database, so once it has been entered, if the user opens the file > Lockdown <, that, too, is opened using this password by default, so the user has admin privileges.

=> The apps thus don't actually have to be identical. The > Unlockdown < one might as well be empty.

Right?

I just noticed one little detail, maybe you can explain it:

- In the file > Lockdown <, the script_line > Section application < is closed off with a semicolon;

- In the file > Unlockdown <, the first line, > Section access < is closed off in this way, but the second one, > Section
application < is not

What is the reason for that? I guess it is important for the whole thing to work as expected.

Re: SECTION ACCESS with NTNAME

awhitfield — Fri, 22 May 2015 11:18:09 GMT

Unlockdown only needs the section access stuff, that's all, sorry if I didn't make that clear!

Your actual app just needs the hidden script bit and the document security settings

re the ; never even noticed it was missing! Ha ha!

Andy

Re: SECTION ACCESS with NTNAME

datanibbler — Fri, 22 May 2015 11:53:03 GMT

Hi,

there was one more thing I just noticed.

Though not able to do much messing in my app, the users would still be able to see the other sheets via the main_menu. But adding some visibility_conditions to those sheets did that trick as well.

The script (or the part of it that loads the role that one user is assigned) is reloaded right away upon opening

and all the sheets now have a visibility_condition depending on that role.

Re: SECTION ACCESS with NTNAME

prabhu0505 — Mon, 18 Jul 2016 15:53:17 GMT

Hi Marcus -

Can you pls share the disadvantages of DMS?

Re: SECTION ACCESS with NTNAME

marcus_sommer — Mon, 18 Jul 2016 20:37:59 GMT

I'm not sure if I'm aware of all disadantages which the use of DMS with custom users as authentification-method might have but I think the main disadvantages are that you couldn't use SSO (SingleSignOn) which meant that the user don't need a login to qlikview and that the method to lease a licence to a desktop client is quite user-unfriendly (there are several steps necessary because the qvp-protocol isn't available).

Maybe there are further advantages/disadvantages which I don't know because I have never used the NT authentification in a productive environment and my testing-experiences was for ages.

- Marcus