Section Access only allowing USER or ADMIN, but not both.

[QlikyNicky]

Hi,

I have an odd issue with my section access.  Only ADMINs are getting access (not USERs), so I loaded my section access into a table to see what it was doing. That's when I discovered if I include a mix of ADMIN and USER users, only the ADMIN ones are loaded. If I change it to be only USER (or even add in some others like TEST, DUMMY etc) , then it loads everything. I've tried loading the section access inline and also from an xlsx file.

My section access script:

Section Access;

LOAD * inline [

ACCESS,USERID,COST_CENTRE
ADMIN,ABCDE\abc1111,*
USER,ABCDE\def2222,1000
USER,ABCDE\ghi3333,2000
];

section application;

My table script:

TEST:
LOAD * inline [
ACCESS,USERID,COST_CENTRE
ADMIN,ABCDE\abc1111,*
USER,ABCDE\def2222,1000
USER,ABCDE\ghi3333,2000
];

So my question is, how am I supposed to have ADMIN and USER in section access? Or am I supposed to only have ADMIN or USER, not both?

[andoryuu]

Your user and admin need to be in two separate loads (i know, it simply concatenates them together, but remember sometimes Qlik Sense is tricky!!).  I tested this script below and was able to get it to work for both the admin and user accounts.  NOTE: Do not use * with admin records.  It is NOT granting all like it does with users.  It will grant all rows to ALL ADMINS which I don't think is what you want (sometimes you want to restrict admins even though they can see all fields).  To grant all values to admins simply leave the restriction field blank like how I have below.

Section Access;

LOAD * inline [

ACCESS,USERID,COST_CENTRE
USER,MORGANLEWIS\MP075907,1000
USER,MORGANLEWIS\MP071663_E,*
];

LOAD * inline [
ACCESS,USERID,COST_CENTRE
ADMIN,MORGANLEWIS\MP071663,
];

section application;

TEST:
LOAD * inline [
AccessLevel,UserValue,COST_CENTRE
adfg,ABCDE\abc1111,*
asdf,ABCDE\def2222,1000
qwer,ABCDE\ghi3333,2000
];

Exit Script;

[y_grynechko]

Good Morning,

I am honestly not sure what is going on with your script and why it works this way. Never had similar issue and was unable to re-create it. But in section access you can add users and admins like documented in here:

https://help.qlik.com/en-US/sense/November2019/Subsystems/Hub/Content/Sense_Hub/Scripting/Security/m...

[andoryuu]

@y_grynechko , no @QlikyNicky  is correct.  When you test out the script in Qlik Sense USER rows will not get access when included with ADMIN.  You have to do it as two separate loads that concatenate together.  You can test this modifying my script above with user accounts in your domain to see the results.

[QlikyNicky]

Thanks @andoryuu , unfortunately I'd already tried separate ADMIN and USER loads in my experiments. It still has the same effect of only applying the ADMIN access (just tested again for good measure).

As a separate note, I also have an issue when I leave the restriction field blank for an ADMIN, they only see data where the restriction field is null in the data set. But one problem at a time 😕

[QlikyNicky]

Thanks @y_grynechko , I used that very page when I was first setting up my section access, which is why my issue is very confusing.

[andoryuu · Accepted solution]

After testing this some more, I think your test app is getting fouled up by having fields that have the reserved USERID and ACCESS keywords.  Those can't be fields in your Section Application.  Try changing them to UserNameValue and AccessLevel and reload your data.  It actually *should* work in a single table per the documentation.  

[y_grynechko]

I am not sure where you take your solutions from @andoryuu.

1. You can load admin access and user access from the same table 

2. I am using this headers:

Section Access;
LOAD
"ACCESS",
"USERID",
PROJECTID
FROM **************;

Table: 

and they work so I don't know why this would be the issue. 

[andoryuu]

@QlikyNicky  - Since it appears that neither @y_grynechko  nor I have been able to help you with this problem so far would you be able to post your QVF for us to have a look at?  Also, what version of QS are you on?

[QlikyNicky]

Thanks @andoryuu ,

It was indeed my test table that was causing this particular issue of not allowing ADMIN and USER. After renaming the fields in my test table, I'm now able to add ADMIN and USER into a single Section Access script. I have tested the access and it works correctly. I may now still bump into the issue I was having which drove me to add in my test table in the first place (so maybe a new post coming in the near future); but for the issue of this posting, this is the correct fix.