Section Access - User specified in Access table cannot open App

[Oggy172]

I have a rather strange issue with my section access for an app.

I am using an app prior to this to create a Section Access QVD as the reduction is be based on what permissions they have for certain tables in our ERP.

2 Developers are hard coded as Admin, the rest to be Users

and I can confirm the user is present (Rob)

I then call this Section Access qvd into another App:

However he gets Access Denied. He is a tenant admin/professional licence etc.

Another user (I only have a handful of test users) can access fine.

Rob can access other documents that we load the Section Access from a spreadsheet, using the same USER.EMAIL - although in those he has Admin. 

Any ideas? 

[marcus_sommer]

You may check if the user is applied as ADMIN as well as an USER which might lead to a conflict.

[Or]

I would be inclined to suspect the reduction. Have you tried removing it? Likewise, have you tried loading the table in Application mode (rather than Section Access) to see if the tables link correctly? Made sure both sides of the link are the same data type (numeric or text, presumably)? 

[Oggy172]

There's only 2 Admins, I'm one, Rob isn't the other.

Everyone else is hardcoded as a USER

[Oggy172]

Yes, all works as you would expect.

As I said, Another user (Jamie) could access it fine. 

Anyway, I basically made it a conditional statement of:

if( USER.EMAIL = Rob@domain.tld , 'ADMIN', 'USER') as ACCESS 

and that works, not sure why he doesnt work as a USER though

[marcus_sommer]

Like hinted by @Or comment the section access; statement to disable this feature to check if the access is in general possible and not prevented by any other security setting/rules.

If then the access is working it's really caused from the section access and if not you need to look for the file-rights or any security rules.

If the section access is the reason you could check the data of the access table in relation with the linked facts/dimension. If the user is really there and has any relation to in the section access listed values? If not the data-load and/or the data-quality and/or the listed matching is failing in any way. 

[marcus_sommer]

The access control needs to be valid on both sides - the access definitions within the access table as well as appropriate linked values within the data-set.

[Oggy172]

That's not true.

To open a document (where he is experiencing the issue) - he need only be listed within Section Access; the data reduction is secondary to that.

Toggling Admin/User should not dictate whether he can open the Application (as I understand it) - however this was the fix.

[marcus_sommer]

I'm not so sure about it. In QlikView it's different. If a data-reduction is applied an user must be listed and having any related values within the reduction-definition. At least if the access control is aimed to ensure confidential information. By disabling the strict-mode or using ADMIN with document-properties like no restrictions for ADMIN or similar stuff the section access becomes potentially vulnerable and is more a kind of usability then secure. In Sense it may have changed ... 

[Oggy172]

I just checked in QV, and listed as a User, with an arbitrary value as my data reduction, I was still able to open the document