topic Re: section access - * values in QlikView

section access - * values

Alex — Wed, 25 Nov 2020 16:16:04 GMT

Hi all,

The idea is to have two different User-Level Access values (ACCESS_A and FULL ACCESS). People with ACCESS_A will have access to one ore more ACCOUNTS while those with FULL ACCESS will be able to see all accounts.

As an admin, I'm trying with qlikview desktop in my local pc and it works perfectly. If I have full access, I can see all data but If I change to ACCESS_A I only see some specific accounts.
The problem comes when I publish the document to INTEGRATION where it works with ACCESS_A but for full access raises the following error: "Access denied. You're not able to open the document 19"

My config and code below:

settings > document properties > opening > initial data reduction based on section access and strict exclusion (both checked)

SECURITY:
LOAD * INLINE [
ACCCESS,NTNAME,User-Level Access,Account_Key
USER,AUTH\USER_1,ACCESS_A,ACCOUNT_A
USER,AUTH\USER_2,*,*
USER,AUTH\USER_3,ACCESS_A,ACCOUNT_B
];

Concatenate
LOAD * INLINE [
ACCCESS,NTNAME,User-Level Access,Account_Key
ADMIN,AUTH\SERVICE_ACCOUNT_INTEGRATION,*,*
ADMIN,AUTH\SERVICE_ACCOUNT_PRODUCTION,*,*
ADMIN,AUTH\ADMIN,*,*
];

//Section Access
section access;

LOAD *
RESIDENT SECURITY;

section Application;

Any idea?

Thanks for your support!

Re: section access - * values

Alex — Mon, 03 Dec 2018 13:24:47 GMT

After the section application statement I have something like:

LOAD * INLINE [
Account_Key, Amount
ACCOUNT_A, 100
ACCOUNT_B, 100
ACCOUNT_C, 100
ACCOUNT_D, 100
];

Re: section access - * values

Alex — Mon, 03 Dec 2018 13:40:12 GMT

I tried unchecking "strict exclusion" and it worked but I don't know what's happening exactly.

Someone who can help on that, please?

Re: section access - * values

albert_guito — Mon, 03 Dec 2018 15:08:17 GMT

Hi, You have to use the Field Names in Seccion Access in UpperCase

Re: section access - * values

Alex — Mon, 03 Dec 2018 16:05:54 GMT

Hi Albert,

Already tried but still not working (pic attached)

Re: section access - * values

albert_guito — Mon, 03 Dec 2018 17:09:18 GMT

Try to remove the astherix ...

section access;

SECURITY:
LOAD * INLINE [
ACCESS,USERID,PASSWORD,ACCOUNT_KEY
ADMIN,ADMIN,admin,
USER,USER_1,1,ACCOUNT_A
USER,USER_2,2,
USER,USER_3,3,ACCOUNT_B
];

section application;
Data:
LOAD * INLINE [
ACCOUNT_KEY, Amount
ACCOUNT_A, 100
ACCOUNT_B, 100
ACCOUNT_C, 100
ACCOUNT_D, 100
];

Also, correct the ACCESS field in your code, has an additional C 🙂

Albert

Re: section access - * values

Alex — Mon, 03 Dec 2018 17:30:19 GMT

Hi Albert,

With blank space is not filtering by any ACCOUNT so not working.

I've realized that the problem comes with the '*'. In local I can open the document because I'm admin but if I change myself to USER I'm not able to do it.

However, if I set a specific account the reduction is fine. What's happening with the '*', then? :S

Re: section access - * values

albert_guito — Tue, 04 Dec 2018 09:17:08 GMT

Can you try if this sample is running for you?

Also I attach screenshots for every reduction applied.

You can see there how astherix (User_2)shows the list of Accounts you are using in the secction access, and empty show all (admin).

Albert

Re: section access - * values

albert_guito — Tue, 04 Dec 2018 09:18:42 GMT

The rest of screenshots (we only upload 3 files per post 😞

Re: section access - * values

Alex — Tue, 04 Dec 2018 10:01:45 GMT

Hi Albert,

Still doesnt' work with blank space.

If I set my user with access = "USER" instead of "ADMIN" and ACCOUNT_KEY = "*" instead of some specific accounts, I can't access to Qlikview (access denied). Find attached the security.qvd format.

Btw, USER-LEVEL ACCESS is just to hide/show some buttons in the main pane.

The section access code:

section access;

LOAD ACCESS,
NTNAME,
ACCOUNT_KEY
FROM
[..\..\Data\Delivery_Hours_Dashboard\Security.qvd]
(qvd);

section Application;

OLEDB CONNECT TO XXX;

SQL SELECT distinct R.regionalID as ACCOUNT_KEY,
R.regionalName as 'Account Name'
FROM Regional R;

Re: section access - * values

Alex — Tue, 04 Dec 2018 10:02:49 GMT

Hi Albert,

Still doesnt' work with blank space.

If I set my user with access = "USER" instead of "ADMIN" and ACCOUNT_KEY = "*" instead of some specific accounts, I can't access to Qlikview (access denied). Find attached the security.qvd format.

Btw, USER-LEVEL ACCESS is just to hide/show some buttons in the main pane.

The section access code:

section access;

LOAD ACCESS,
NTNAME,
ACCOUNT_KEY
FROM
[..\..\Data\Delivery_Hours_Dashboard\Security.qvd]
(qvd);

section Application;

OLEDB CONNECT TO XXX;

SQL SELECT distinct R.regionalID as ACCOUNT_KEY,
R.regionalName as 'Account Name'
FROM Regional R;

Re: section access - * values

albert_guito — Tue, 04 Dec 2018 15:00:11 GMT

Ummm ... you have to be carefull with the order of reloads when uses seccion access.

You allways have to do it within an ADMIN user without reductions.

Did you run the sample I attached?

Albert

Re: section access - * values

Alex — Tue, 04 Dec 2018 23:26:38 GMT

After doing some changes it works in local as expected.

However, once I move to the Content development environment and the server runs the .qvw I can't open it from the access point (failed to open, again).

The point is that if I download the reloaded .qvw to my desktop, I'm able to open it and the security is applied as expected.

I only add one line in the security.qvd with my AUTH NTNAME and USER = "ADMIN". I have also added the service accounts for both servers.

What's the problem in the server then?