topic OSUser with Active Directory Groups in QlikView

OSUser with Active Directory Groups

sergio0592 — Fri, 24 Jun 2016 09:50:38 GMT

Hi all,

I use the OSUser for hide or show charts/ tabs in my apps. I use only with 'DOMAIN\User_name'.

Do you know if it's possible to use with Active Directory Groups, because it could be faster instead write OSUser() = 'DOMAIN\UserA' or OSUser() = 'DOMAIN\UserB' or OSUser() = 'DOMAIN\UserC' .....

Thanks

Re: OSUser with Active Directory Groups

Peter_Cammaert — Fri, 24 Jun 2016 10:11:05 GMT

No that won't work. AD Users are never uniquely identified by a group name, only by a user name. So OSUser() will always return the unique accountname of the user that is currently logged in. Not the maybe 15 groups he/she may be member of.

Moreover, groups are only used to distribute permissions across groups of users instead of every user individually. For example, if I need access to a QlikView document and permissions to this document are managed using a group name, then I become member of that group and at the same time earn all permissions that are assigned t othat group. But I will still be known everywhere in AD as my accountname.

Best,

Peter

Re: OSUser with Active Directory Groups

marcus_sommer — Fri, 24 Jun 2016 10:31:14 GMT

Your query for the osuser could be simplyfied with:

match(osuser(), 'DOMAIN\UserA', 'DOMAIN\UserB', ...)

or you could extend it for a lookup-logic like:

pick(match(osuser(),

'$(=concat(NTNAME, chr(39) & ',' & chr(39), RecNo))',

'$(=concat(GROUPNAME, chr(39) & ',' & chr(39), RecNo))')

whereby you need a table of your users-usergroup matching. With them and if the data are really confidental and/or you want to implement a very strikt usability it's recommended to use section access to control the access on data, objects and sheets (and within section access you could also use user-groups for the autorization).

Section Access

- Marcus

Re: OSUser with Active Directory Groups

Peter_Cammaert — Fri, 24 Jun 2016 10:51:36 GMT

Sorry, Marcus' post made me realise that I partially misread your question. Of course you can use AD Groups to better manage access to documents and data, only not with OSUser(). Section Access does support AD Groups.

Peter

Re: OSUser with Active Directory Groups

sergio0592 — Fri, 24 Jun 2016 11:11:10 GMT

Thanks Markus, i'll read carefully your post about Section Access.