topic Re: user access using windows domain groups in QlikView

user access using windows domain groups

Wed, 19 Oct 2011 08:47:05 GMT

Hi All,

Can QlikView read the Windows Active Directory to see which user groups a Domain ID belongs to?

Many thank,

Phil

user access using windows domain groups

Wed, 19 Oct 2011 08:50:06 GMT

Qlik reads this automatically when user opens document.

In section access table that info must be in NTNAME field.

C u,

Stefano

user access using windows domain groups

Wed, 19 Oct 2011 08:51:12 GMT

Hi,

It can, but I don't think it works well if people are viewing through access point. How are your files being deployed? In my last company we used the IE plugin and had files loaded onto our intranet ... that worked well, but you need to keep everyone's version of the plugin up to date.

We didn't use the access point route so I'm not sure if it's possible to get it to work the same way there.

Cheers,

Emma

user access using windows domain groups

Wed, 19 Oct 2011 08:56:31 GMT

Thanks Stefano

user access using windows domain groups

Wed, 19 Oct 2011 09:05:00 GMT

Hi Emma,

Unfortunately we're using Access Point.

When you published this on your Intranet was it just a normal webserver running IIS?

Also publishing that way were you able to read the user groups in Qlik to say show/hide tabs depending on which groups a domain ID belonged to?

Many thanks,

Phil

user access using windows domain groups

Wed, 19 Oct 2011 09:05:33 GMT

If you want show only some qvw to only some user, u can create a windows group and in the file property of that qvw give the access to that group.

So the access point page has qvw filtered by the user access...

I hope thie helps.

Stefano

user access using windows domain groups

Wed, 19 Oct 2011 09:13:14 GMT

Thanks Stefano, that would work though the Qlik app is quite large our network admin will not allow us to have the app on the server a few times so we can control access by user group... this is a tricky one

user access using windows domain groups

Miguel_Angel_Baeyens — Wed, 19 Oct 2011 10:05:57 GMT

Hi Phil,

QlikView actually can read data from Active Directory, and you can build a section access according to the Users under some groups or so. Note that there two steps: authentication (who can see the document) and authorization (what this user can see once he has logged onto the document).

Authentication is done by Active Directory using the credentials of the current session. Since QlikView doesn't check anything here, if the user belongs to a group that has NTFS permissions to see the root or mounted folders, the user will see the documents. If the user belongs to a group that does not have permissions on that folder, the document will not be accessible to that user.

Authorization is usually done by section access. There are a lot of threads covering this issue, but you can start with this, this and this threads.

Hope that helps.

Miguel Angel Baeyens

BI Consultant

Comex Grupo Ibérica

user access using windows domain groups

Wed, 19 Oct 2011 10:36:18 GMT

Many thanks Miguel,

I'll have a look through the links.

Kind Regards,

Phil

user access using windows domain groups

Wed, 19 Oct 2011 10:45:31 GMT

Hi Miguel,

I had a look through though I really don't want to use data reduction to limit what users can see.

As all users are able to see a summary of all the data but only a selection of users can view all the underlying detail.

Then some other users are restricted to only data for their own team and the rest only their own data.

What I was hoping to be able to do was for a Domain ID to be allocated a role of e.g. ALL, TEAM, OWN then based on that role have something in the set analysis that shows the detail restrict the data based on that role.

Is that possible?

Many thanks,

Phil

Re: user access using windows domain groups

Miguel_Angel_Baeyens — Wed, 19 Oct 2011 12:08:55 GMT

Hi Phil,

Yes, that is possible, using section access and NTNAME, and a correspondence field, for each user, not in the section access, that you will use later on in the set analysis. Something like

SECTION ACCESS;
LOAD * INLINE [
ACCESS, NTNAME
ADMIN, DOMAIN\ADMINISTRATOR
USER, DOMAIN\CEO
USER, DOMAIN\TEAMMGR
USER, DOMAIN\ME
];
SECTION APPLICATION;
Membership:
LOAD * INLINE [
NTNAME, Group
DOMAIN\CEO, ALL
DOMAIN\TEAMMGR, TEAM
DOMAIN\ME, OWN
];
// This variable stores the group I belong to (one to one relationship) to be used in the set analysis
LET vMyGroup = Lookup('Group', 'NTNAME', OSUser(), 'Membership');

So the expressions would be, for example

Sum({< Group = {'$(vMyGroup)'} >} Value)

Hope that helps.

Miguel Angel Baeyens

BI Consultant

Comex Grupo Ibérica

user access using windows domain groups

Wed, 19 Oct 2011 14:18:33 GMT

Thanks Miguel, I think I understand and it looks like what I need... wish me luck

Kind Regards,

Phil

Re: user access using windows domain groups

Wed, 19 Oct 2011 14:51:30 GMT

Hi Miguel,

Am I correct to say these profiles are created in QlikView and not user groups assigned to a Domain ID in Windows?

It's just that I was hoping to use a Windows user group assigned to a user as opposed to having to assign a role for each individual user account in a QlikView script.

Many thanks,

Phil

Re: user access using windows domain groups

Miguel_Angel_Baeyens — Wed, 19 Oct 2011 18:16:31 GMT

Hi Phil,

That's correct, that "Group" is a new field I have created in QlikView. If you want to retrieve group information from the AD you will need to use the built in OLE DB to get to Windows Active Directory Services.

Regards.

Miguel Angel Baeyens

BI Consultant

Comex Grupo Ibérica