Qlik Sense Section Access Issue

[Anonymous]

Hi,

When I tried OMIT a field to a user using Section Access In Qlik Sense, User is getting Invalid Dimension Error instead of the field being omitted ? is it a bug?

[Vasiliy_Beshentsev]

Provide part of your app to see this if you can.

[Anonymous]

Section Access:

Load * Inline [
ACCESS, USERID, OMIT
USER, GOTRANSIT\RAMV, PASSENGERNAME
];

Section Application;

PII:
Load * Inline [
PASSENGERID, PASSENGERNAME, COSTINVOLVED
1, ABC, 1000
2, PQR, 2000
3, XYZ, 3000
4, ZZZ, 4000
];

[Vasiliy_Beshentsev]

Your load script is wrong.

I really can't understand what you try to achieve there.

In section access table looks everything is correct, but in 'Pll' table there must be OMIT field. You haven't it here. Than you have PASSENGERNAME value in OMIT field and that is the name of field in 'Pll' table? What is going on?

Try this code:

Section Access:

Load * Inline [
ACCESS, USERID, PASSENGERNAME
USER, GOTRANSIT\RAMV, PQR
];

Section Application;

PII:
Load * Inline [
PASSENGERID, PASSENGERNAME, COSTINVOLVED
1, ABC, 1000
2, PQR, 2000
3, XYZ, 3000
4, ZZZ, 4000
];

So than user with USERID = GOTRANSIT\RAMV will get access to PASSENGERNAME = PQR.

That is how it works correct.

[Anonymous]

Hi Vasiliy,

Thanks for your time.

I think you are talking abt Row Level security. But, I am looking for column level security. I need to omit (make it invisible) the column PassengerName completely to the user RamV..

Please take a look at the column level security in QS.

Thanks

[Anonymous]

If you are omitting a column and that column is used in the visualization it is understandable that the visualization wouldn't work.

[dwforest]

Its not a bug. The column is omitted from the data model, therefore you cannot use it in a visualization.

Basically what you need to do is instead of omitting PASSENGERNAME, you need to create a crosswalk table that grants access to it.

Create a table and pull PASSENGERNAME into it with a ACCESS_PN flag field

LOAD

  'Y' as ACCESS_PN,

PASSENGERNAME,

PASSENGERID

RESIDENT [datatable];

LOAD

  'N' AS ACCESS_PN,

  Null() AS PASSENGERNAME,

  PASSENGERID

RESIDENT [datatable];

This creates a field with the actual values and null values, then you can you row level security to select which they can see.

[Anonymous]

Hi David,

It's a good work around and it works, thanks.

But,  OMIT field is meant to provide column level security using section access. If it shows the error on the dashboard instead of omitting the field, I wonder what's the purpose of OMIT field in section access?

I think, I need to raise this issue with the Qlik support.

Thanks

[dwforest · Accepted solution]

It is working as designed as far as I understand.

The use case would be for users that are allowed to build their own sheets/visualizations; it is as if that field does not exist for them. If you did have access you could use it.

If you are building an application with mixed access where you use an omitted field, you would additionally have to block access to the sheet for those without access to the field so they do not get the error.

Since the section access is happening at data load, there is no way for the visualization layer to know that the field was blocked versus not existing...

We might suggest an enhancement that allows for default values to be applied to "invalid" fields in lieu of the visualization breaking.

[Anonymous]

Thanks for your time David.