topic Re: Section Access NTNAME in QlikView

Section Access NTNAME

MK_QSL — Fri, 01 Apr 2016 09:07:20 GMT

I am facing a strange request which is difficult for me to fulfil.

I have developed an QV app and allocated to users with NTNAME section access.

Section Access example is shown below.

Section Access;
LOAD

ACCESS as ACCESS,

UPPER(NAME) as NTNAME,
UPPER(DEPARTMENT) as DEPARTMENT
INLINE

[

ACCESS, NAME, DEPARTMENT

ADMIN, DOMAIN\MANISH, *

USER, DOMAIN\A, DEPT1

USER, DOMAIN\B, DEPT2

USER, DOMAIN\C, DEPT3

USER, DOMAIN\D, DEPT4

USER, DOMAIN\E, DEPT5

ADMIN, JAMES, *

];

Section Application;

I am having an admin rights. But JAMES our IT Head also want to have Admin rights but he wants to open this application from his Personal computer without joining to Network so no domain name (Not on Access Point)

Is there any way to handle this in QlikView?

Re: Section Access NTNAME

er_mohit — Fri, 01 Apr 2016 09:13:26 GMT

Just change the name with domain\username (Username is computer name).

Add one line Star is * ; next to Section access ;

Hope it helps

Re: Section Access NTNAME

MK_QSL — Fri, 01 Apr 2016 09:14:24 GMT

Can't change name to domain\username. It's easy...

Question is he is having a personal computer without domain.

Re: Section Access NTNAME

er_mohit — Fri, 01 Apr 2016 09:27:56 GMT

On front end side use OSuser() . Copy that name and replace it with James name.

Hope it helps

Re: Section Access NTNAME

stevedark — Fri, 01 Apr 2016 09:34:59 GMT

Hi Manish,

You just need to blend both NTNAME and USERID/PASSWORD access, and use a * for fields not used. So to start from your code, you would have:

Section Access;
LOAD

ACCESS as ACCESS,

UPPER(NTNAME) as NTNAME,

UPPER(USERID) as USERID,

PASSWORD as PASSWORD,
UPPER(DEPARTMENT) as DEPARTMENT
INLINE

[

ACCESS, NTNAME, USERID, DEPARTMENT, PASSWORD

ADMIN, DOMAIN\MANISH, *, *, *

USER, DOMAIN\A, *, DEPT1, *

USER, DOMAIN\B, *, DEPT2, *

USER, DOMAIN\C, *, DEPT3, *

USER, DOMAIN\D, *, DEPT4, *

USER, DOMAIN\E, *, DEPT5, *

ADMIN, *, JAMES, *, P@55W06D

];

Now, if someone goes in that matches a given NTNAME they will go straight in. Anyone that does not match will be prompted for a Username and Password combo. The only one that will work is JAMES.

The only downside of this approach is that users with no access will get a username password prompt - where previously they will have been told straight away they have no access.

You can combine NTNAME and USERID in various ways. For example, I have had a combination of NTNAME and USERID with both populated, so that the NTNAME dictates that a user could get in, but once a user was authenticated they could use a USERID to dictate what subset of data they saw within the app.

Hope that helps,

Steve

Re: Section Access NTNAME

kaushiknsolanki — Fri, 01 Apr 2016 09:36:10 GMT

Hi,

All you have to do is for that user you should use the computername as Domain name. SO the script will be

Section Access;
LOAD

ACCESS as ACCESS,

UPPER(NAME) as NTNAME,
UPPER(DEPARTMENT) as DEPARTMENT
INLINE

[

ACCESS, NAME, DEPARTMENT

ADMIN, DOMAIN\MANISH, *

USER, DOMAIN\A, DEPT1

USER, DOMAIN\B, DEPT2

USER, DOMAIN\C, DEPT3

USER, DOMAIN\D, DEPT4

USER, DOMAIN\E, DEPT5

ADMIN, COMPNAME\JAMES, *

];

Regards,

Kaushik Solanki

Re: Section Access NTNAME

stevedark — Fri, 01 Apr 2016 09:36:50 GMT

I would be slightly concerned though about your app being exposed to the internet without users first being authenticated.

Can you not use some kind of VPN solution to authenticate him on the domain?

Steve

Re: Section Access NTNAME

MK_QSL — Fri, 01 Apr 2016 09:53:07 GMT

Hi Steve,

Thanks for your quick response. I will test this and come back to you on this.

Re: Section Access NTNAME

MK_QSL — Fri, 01 Apr 2016 09:53:28 GMT

Hi Kaushik,

Will try this and let you know the result.

Re: Section Access NTNAME

tamilarasu — Sat, 02 Apr 2016 20:08:26 GMT

Hi,

What I have suggested (Deleted comment) already is working fine in my personal laptop. Use Osuser() function to get the computer Name\windows login id and copy paste the same in NTNAME field.

In your case,

Section Access;
LOAD

ACCESS as ACCESS,

UPPER(NAME) as NTNAME,
UPPER(DEPARTMENT) as DEPARTMENT
INLINE

[

ACCESS, NAME, DEPARTMENT

ADMIN, DOMAIN\MANISH, *

USER, DOMAIN\A, DEPT1

USER, DOMAIN\B, DEPT2

USER, DOMAIN\C, DEPT3

USER, DOMAIN\D, DEPT4

USER, DOMAIN\E, DEPT5

ADMIN, XXXX\TAMIL, *

];

Section Application;

XXXX is a computer name or it can be domain name.

When you install Windows, installer ask you to enter your name, and optionally, the organization name. You can check what has been entered by click Start, click Control Panel and then click System.

So, he can open the application in the personal computer by using his computername\loginID in NTNAME field.

Re: Section Access NTNAME

stevedark — Sun, 03 Apr 2016 07:13:30 GMT

This approach of using a machine name sounds insecure to me. If someone

knew the username of a user (from QMC, Ops Monitor, log files or looking at

a locked machine etc.), they could rename their machine to match the

machine name of the user and create a user with the same name and then get

access to apps and data they should not be allowed to.

I'm not sure what would happen if a user set up a machine with the same

name as the domain whether that could then be used to gain access to

QlikView documents. It seems to follow that they could.

This is why whenever domain access is used the NTDOMAINSID should also be

used, as this is harder to find for a hacker and much harder (impossible?)

to spoof.

Steve

Re: Section Access NTNAME

Kushal_Chawda — Sun, 03 Apr 2016 07:38:09 GMT

I think you can implement the SSL VPN setup so that the user who want to access the application over internet can connect through VPN over secure network to gain the access.

Re: Section Access NTNAME

stevedark — Sun, 03 Apr 2016 12:17:06 GMT

Indeed, a VPN solution would perhaps be the best way ahead, but the

original question was around having a login without a domain, rather than

different ways of using domains and computer names. That requires the use

of USERID.

Steve

Re: Section Access NTNAME

Kushal_Chawda — Sun, 03 Apr 2016 14:20:23 GMT

Yeah steve, you are correct, if user is going to access the application over internet(using SSL VPN) he will not be actually logged in as domain user, so he need to access it using USERID and PASSWORD.

Re: Section Access NTNAME

MK_QSL — Tue, 05 Apr 2016 11:04:14 GMT

Hi Steve,

I have tested and glad to let you know that it is working as per my requirements.

Thanks for your solution.

Regards,

Re: Section Access NTNAME

stevedark — Tue, 05 Apr 2016 15:58:32 GMT

No problems Manish - glad it is now working.

Steve