topic Re: QVW Metadata - Entries missing from Lineageinfo in QlikView

QVW Metadata - Entries missing from Lineageinfo

richardpayne — Tue, 06 Jun 2017 15:47:11 GMT

I am reading all QVWs in our production environment as XML and doing a simple where-used on the QVDs which contain our section access field security definitions. In all cases, the security QVD is loaded in the hidden script.

Some QVWs do not show the security QVDs in the LineageInfo table. I can't seem to see why. Is there a setting I need to check on the QVWs? Between those that show the QVD in the XML and those that do not, the hidden scripts and document security properties seem to be consistent.

Re: QVW Metadata - Entries missing from Lineageinfo

prieper — Tue, 06 Jun 2017 16:15:54 GMT

Can you post an example?

Can only think that either there is something wrong with the Section Access .... Section Application or that probably some info is written into hidden section of the script.

Re: QVW Metadata - Entries missing from Lineageinfo

richardpayne — Tue, 06 Jun 2017 17:44:27 GMT

I will look into generating some test cases and hopefully I can recreate the problem. I have to alter the documents due to sensitive data.

The section access is consistent between them and, as I mentioned, all security QVD references exist in the hidden scripts of these QVWs. My initial question is trying to understand where I need to look for inconsistencies between the documents because offering samples here requires that I alter them for public consumption.

Re: QVW Metadata - Entries missing from Lineageinfo

rwunderlich — Wed, 07 Jun 2017 04:12:54 GMT

To my knowledge, hidden script does not generate <LineageInfo> elements. To clarify, are you saying that you have hidden script that is generating <LineageInfo> elements for QVDs that are referenced in the hidden script? Is that same QVD being loading again outside the hidden script?

-Rob

Re: QVW Metadata - Entries missing from Lineageinfo

richardpayne — Wed, 07 Jun 2017 13:07:44 GMT

Absolutely, yes. Some of my QVWs show the QVD loaded in the hidden script to be in the Lineageinfo. The QVD shown from the hidden script is not referenced anywhere else in the documents script. Since the QVDs in question are for section access, they are loaded within the hidden script.

Re: QVW Metadata - Entries missing from Lineageinfo

richardpayne — Wed, 07 Jun 2017 17:51:45 GMT

Attached is an example. This proves Lineageinfo is pulled from hidden script.

Password for hidden script is "password".

I do not appear to be able to recreate the issue where the hidden script is *not* included in Lineageinfo. I'm eager to know how I can make this information consistently available in documents which use section access QVDs in a hidden script.

Re: QVW Metadata - Entries missing from Lineageinfo

rwunderlich — Wed, 07 Jun 2017 23:32:31 GMT

I see your example is QV11.20. QV12 changed the rules to suppress <LineageInfo> from hidden script. I've attached your sample loaded in V12 to demonstrate this.

Why in V11, you sometimes see the lineage info, sometimes not? There are some odd behaviors around LineageInfo having to do with dropping tables and a couple of other quirks. Perhaps that is the source of your inconsistency.

In any event, the technique won't work at all once you go to QV12. .

-Rob

http://masterssummit.com

http://qlikviewcookbook.com

Re: QVW Metadata - Entries missing from Lineageinfo

richardpayne — Thu, 08 Jun 2017 00:22:01 GMT

Got it. Any recommendation of how to do a "where used" of our section access QVDs? Are we destined to maintain it manually in a spreadsheet?

Re: QVW Metadata - Entries missing from Lineageinfo

rwunderlich — Thu, 08 Jun 2017 04:43:55 GMT

The question I would ask is: What is the reason to build your Section Access in the hidden script? Can you build it in the normal script?

-Rob

Re: QVW Metadata - Entries missing from Lineageinfo

richardpayne — Thu, 08 Jun 2017 12:55:00 GMT

"We've always done it that way."™

Our initial implementation consultants suggested it, so it became standard. Early on, we also shared some development with users who wanted to design their own dashboards.

Re: QVW Metadata - Entries missing from Lineageinfo

rwunderlich — Thu, 08 Jun 2017 13:52:13 GMT

There tends to be this automatic assumption to put SA script in the hidden, but I no longer follow this practice unless there is a specific reason. I think it's left over from the days when we may have put actual passwords in SA. These days, almost everyone uses the NTUSER with no password. Hidden script is a pain and I avoid it. I also don't think hidden script for SA adds meaningful to the security of the app.

Consider this story. BI Manager Sally supervises Junior QV Dev Frank. Under the security policy of the company, Sally is the only person who can update the SA tables. So Sally has write access to the SA source, whether that's a SQL table or a QVD.

Frank reloads qvws when doing desktop development. So Frank needs read access to the SA source. Meaning he could always read the source table if he wanted to. The only security hidden script provides is that it makes it harder for Frank to figure out the name of the SA source. If we need to keep Frank that isolated (not a bad thing) then Frank's development should probably use Development versions of the SA tables.

My two cents.

-Rob

http://masterssummit.com

http://qlikviewcookbook.com

Re: QVW Metadata - Entries missing from Lineageinfo

richardpayne — Thu, 08 Jun 2017 18:33:20 GMT

I'll bring these points to the table. Thank you for your time.

Re: QVW Metadata - Entries missing from Lineageinfo

rwunderlich — Thu, 08 Jun 2017 23:39:17 GMT

BTW, loved the ™

Re: QVW Metadata - Entries missing from Lineageinfo

richardpayne — Fri, 16 Jun 2017 20:35:21 GMT

In my tests, moving the section access out of the hidden script and just sticking it at the end of the script works fine. I can now see the QVD in the document's lineageinfo.

To make this whole vision come together, I would love to be able to tell what fields are used from the section access qvd. It doesn't look like it shows these fields being sourced from the section access qvd, but from the data sources. The section access qvd does not appear in the TableDescription or SrcTables metadata entries.

Have I hit a wall here? What I've done so far is valuable, but we use section access over a number of documents, but they don't all use the same fields. Some are less detailed. Our environment is large enough that users are always asking me who has access to what and how documents are restricted. Having the information of what fields are secured allows me to answer every question.

Re: QVW Metadata - Entries missing from Lineageinfo

rwunderlich — Thu, 22 Jun 2017 17:50:08 GMT

As far as I know, Section Access tables by design does not produce metadata for security reasons.

-Rob

http://masterssummit.com

http://qlikviewcookbook.com