topic Re: Section Access - Admin is not really Admin(?!) in QlikView

Section Access - Admin is not really Admin(?!)

Sahal — Wed, 05 Aug 2015 10:40:39 GMT

Hi Qlik Community.

I have a case with qlik about section access and the admin role/rights.

I would like to here you guyse toughts about this.

My section access table looks like this:

1st row is the service account for qlik

2nd row is a user that should see the application and only see the reduced data for division 023

(Now the interesting thing)

3rd row this user should be an ADMIN that should see ALL data in the source document and in the distributed application.

4th row this user should be able to see the application but not be able to access it.

The Strict Exlusion is checked (and it should be)

This should be the way section access work in my opinon and from reading alot of topics here and on google people seams to want the same.

The '*' should not have any meaning in section access (or mabye it should?) but if so then the '*' should be on ALL field values and not only on the reduced values. (USERS ='*'. ADMIN should still se Everything)

I´m i thinking this wrong or what do you guys Think?

/ Thank you.

Re: Section Access - Admin is not really Admin(?!)

Gysbert_Wassenaar — Thu, 06 Aug 2015 08:51:59 GMT

Are you working with the document in the ajax client, i.e. opening it from the access point? If so, then you will always get USER level access. ADMIN level access is not available when opening documents through Qlikview Server.

Re: Section Access - Admin is not really Admin(?!)

Sahal — Thu, 06 Aug 2015 09:03:48 GMT

Hi,

Yes we are using ajax client on access point.

I do understand that the access level on access point vs document level is different but my point is why?.

This makes no seense for section access because how would i go about to give an admin access to all the data without entering all the field values in the reduced field?.

let´s say that the reduced field have 100.000 records should i then make 100.000 rows off data in my reduced field in the section access table? that to me is wrong.

Admin rights should be on both ap and document level and you should be able to leave the reduced field blankor null to be able to see everything.

Re: Section Access - Admin is not really Admin(?!)

simondachstr — Thu, 06 Aug 2015 09:08:10 GMT

You can use an asterix * to give ADMIN access to all reduced data.

Re: Section Access - Admin is not really Admin(?!)

rubenmarin — Thu, 06 Aug 2015 09:19:08 GMT

Hi Sahal, it's a bit tricky but for examples with so many values I prefer to create the section access at the end of script, when I have all values loaded, then I create the admin with all the values and all fields and so when I crete the rest of users * will really get all the values in the field:

Section Application;

LOAD * Inline [

DIVISION, DATA

023, 023

011, 011

001, 001

];

Section Access;

Security:

LOAD * INLINE [

ACCESS, USERID, PASSWORD

ADMIN, ADMIN, ADMIN

];

Join

LOAD FieldValue('DIVISION', IterNo()) as DIVISION

AutoGenerate 1

While IterNo()<=FieldValueCount('DIVISION');

// Using fieldvalue you get all the values, no matter wich table they are

LOAD * INLINE [

ACCESS, USERID, PASSWORD, DIVISION

USER, USER, USER, *

ADMIN, ADMIN2, ADMIN2

USER, USER2, USER2

];

Just take care that section access only allows 1 million different values, if you have more you have to do a bit more work putting them on section application and creating another field to link that table with the security.

Re: Section Access - Admin is not really Admin(?!)

Sahal — Thu, 06 Aug 2015 10:14:20 GMT

Hi, yes i know that but i want the ADMIN to have access to ALL the field values not only the reduced data.

Re: Section Access - Admin is not really Admin(?!)

Sahal — Thu, 06 Aug 2015 10:48:13 GMT

Hi,

i don´t know if im understading this correct .

What im after is to give ADMIN and USER different access rights depeding on what i specify in the ACCESS field.

i have no problem putting '*' on every new reduced field in the section access table.

in your exampel do i have to use the section access 2 times? im using an external table not an inline.

Re: Section Access - Admin is not really Admin(?!)

rubenmarin — Thu, 06 Aug 2015 11:10:01 GMT

Hi, to explain what I'm doing:

//At the end of script I set the section access (only one time, at the end)

Section Access;

//First I load the superadmin

Security:

LOAD * INLINE [

ACCESS, USERID, PASSWORD

ADMIN, ADMIN, ADMIN

];

// And I relate that superadmin with all the values of the DIVISION fields

Join

LOAD FieldValue('DIVISION', IterNo()) as DIVISION

AutoGenerate 1

While IterNo()<=FieldValueCount('DIVISION');

// Using fieldvalue you get all the values, no matter wich table they are

// Then I can use *, as * will be related to all values loaded in section access and we have an user with all the values,

// * will be related to all values in the field (I give it to USER just as an example, usually is given to other admins or users

// without restrictions in that field)

LOAD * INLINE [

ACCESS, USERID, PASSWORD, DIVISION

USER, USER, USER, *

ADMIN, ADMIN2, ADMIN2

USER, USER2, USER2

];

// I used a inline table but usually this is loaded from db or document (xls, csv...)

Re: Section Access - Admin is not really Admin(?!)

Sahal — Thu, 06 Aug 2015 11:51:46 GMT

Hi.

Thank you Ruben this works as expected

In my opinion this solution should go in the manual for section access *How to extract data for all field values*

This is how i did it.

Re: Section Access - Admin is not really Admin(?!)

rubenmarin — Thu, 06 Aug 2015 12:06:33 GMT

Hi Sahal, that's different from what I did and won't work the way I said.

If you make the join at the end with all users, and with the DIVISION field Loaded it won't do anything.

It can work because you hard-coded all the DIVISION values meanwhile my approach load all the values loaded in the model, avoiding the maintenance of hard-coding the values.

Re: Section Access - Admin is not really Admin(?!)

Sahal — Thu, 06 Aug 2015 12:16:19 GMT

Hi Ruben, for me this works.

USER1 only sees DIVISION 023

USER2 sees all data ( i do not have a inline for my acual data i have a table in the DB that contains more the 100.000 records for the DIVISION field this was JUST an example)

Re: Section Access - Admin is not really Admin(?!)

rubenmarin — Thu, 06 Aug 2015 12:21:34 GMT

Ok, just wanted to advise, with that way you can remove the last join and it should work just the same.

Re: Section Access - Admin is not really Admin(?!)

Sahal — Wed, 12 Oct 2016 13:57:28 GMT

Hi,

I would like to bring this topic back to life.

You where right Ruben my approach did not work as expected.

You wrote this:

--------

Section Application;

LOAD * Inline [

DIVISION, DATA

023, 023

011, 011

001, 001

];

Section Access;

Security:

LOAD * INLINE [

ACCESS, USERID, PASSWORD

ADMIN, ADMIN, ADMIN

];

Join

LOAD FieldValue('DIVISION', IterNo()) as DIVISION

AutoGenerate 1

While IterNo()<=FieldValueCount('DIVISION');

// Using fieldvalue you get all the values, no matter wich table they are

LOAD * INLINE [

ACCESS, USERID, PASSWORD, DIVISION

USER, USER, USER, *

ADMIN, ADMIN2, ADMIN2

USER, USER2, USER2

];

--------

How do you relate the superadmin with all the values of division?

Where is the connection between ADMIN and all the data in divison?

Re: Section Access - Admin is not really Admin(?!)

rubenmarin — Thu, 13 Oct 2016 07:22:32 GMT

Hi Sahal, from what I see in the script, first loads the ADMIN and the does a join with all the values in the division field.

Doing a join without any related field (the 2nd table only has the DIVISION field, wich doesn't exists in the first table) will return a combination of all possible values, so here is where the ADMIN is related with all the divisions.

Section Access;

Security:

LOAD * INLINE [

ACCESS, USERID, PASSWORD

ADMIN, ADMIN, ADMIN

];

Join

LOAD FieldValue('DIVISION', IterNo()) as DIVISION

AutoGenerate 1

While IterNo()<=FieldValueCount('DIVISION');