topic Re: Section Access and Section Application in QlikView

Section Access and Section Application

Mon, 06 Jun 2016 15:50:36 GMT

Hello,

I am having trouble with my Section Access/Section Application configuration. In both of the configurations below, I add a "Role" column which I use to determine which objects a user has access to. The "ResourceLoginID" column acts as the field which joins to my data model to limit which records the user has access to.

With the first configuration below, I created an ADNAME as an artificial reduction field. I can access the .qvw application locally as Employee2 and only view Employee2's data & objects, as expected. However, when I deploy the application with the first configuration on the server, I get a message saying "Failed to open document. You don't have access to this document." I'm not sure why this works okay locally but doesn't work when deploying to server.

With the second configuration, I am able to access the application locally and on the server, but I don't have the ability to assign a Role of 'Supervisor' to Employee1.

Do you have any suggestions of what I can do to assign each employee a Role as well as determine whether they have access to only their own data or all of the data?

Configuration 1:

Section Access
ACCESS	NTNAME	ADNAME
ADMIN	Employee1Alias	Employee1Alias
USER	Employee2Alias	Employee2Alias
USER	Employee3Alias	Employee3Alias
SectionApplication
ADNAME	ResourceLoginID	Role
Employee1Alias	*	Supervisor
Employee2Alias	Employee2Alias	Agent
Employee3Alias	Employee3Alias	Agent

Configuration 2:

Section Access
ACCESS	NTNAME	ResourceLoginID
ADMIN	Employee1Alias	*
USER	Employee2Alias	Employee2Alias
USER	Employee3Alias	Employee3Alias
SectionApplication
ResourceLoginID	Role
Employee2Alias	Agent
Employee3Alias	Agent

Thanks for your help!

Re: Section Access and Section Application

Clever_Anjos — Mon, 06 Jun 2016 16:22:05 GMT

ResourceLoginID should be uppercase

Re: Section Access and Section Application

Peter_Cammaert — Mon, 06 Jun 2016 16:27:41 GMT

What Clever is saying is that the link field must always have an UPPER CASE-name.

But in addition to that, all values in that link field must be converted to upper case as well. And "on both sides of the ocean". Section Access converts all data and field names by default to upper case. There won't be any associative relations if Section Application doesn't follow suit...

Best,

Peter

Re: Section Access and Section Application

Mon, 06 Jun 2016 16:32:39 GMT

Thanks, Peter and Clever. I will try converting ResourceLoginID's data and name to upper case.

That doesn't seem to be preventing the second configuration from working as expected, however.

Can you explain why the second configuration is working but not the first?

Re: Section Access and Section Application

Peter_Cammaert — Mon, 06 Jun 2016 20:49:45 GMT

The second configuration doesn't work as expected. At least not for me. I rebuilt your Section Access / Section Application combo, and I always get into this document even when both Data reduction and Strict exclusion are enabled.

This is because when Section access has no fields linking to the outside world, it cannot perform data reduction and will only check your credentials. As soon as I convert the names of the link fields to upper case, I get thrown out with "Access denied" because the link field values don't match.

In short, if you do Section Access, you should do it correctly or the door will stay wide open.

Peter

Re: Section Access and Section Application

Tue, 07 Jun 2016 19:38:49 GMT

Hi Peter,

My data model contains a ResourceLoginID field which links to my Section Access and acts as the reduction field to reduce the records that a user can see. I'm assuming the app doesn't open for you because you don't have that field anywhere in your data model outside of the Section Access script.

Sal

Re: Section Access and Section Application

Peter_Cammaert — Tue, 07 Jun 2016 20:09:01 GMT

This is my script (all of it):

Section Access;

LOAD * INLINE [

ACCESS, USERID, ResourceLoginID

ADMIN, Employee1Alias, *

USER, Employee2Alias, Employee2Alias

USER, Employee3Alias, Employee3Alias

];

Section Application;

LinkTable:

LOAD * INLINE [

ResourceLoginID, Role

Employee2Alias, Agent

Employee3Alias, Agent

];

When you execute this script, Section Access will only grant access, not reduce data because there is no proper link field.

Convert both ResourceLoginID field names to upper case and reload and try to log on with either Employee2Alias or Employee3Alias.. You'll see what I mean (enable Data Reduction and Strict Exclusion in the document properties)

Section Access is pretty tricky to master, I admit.

Peter