Security not working

[Manni_SM]

Hi All  ,

@rubenmarin  @robert_mika     @Vegar 

am using below script in Qliksense section access but its giving me data not reloaded error. 

Section access;
Security:
LOAD * INLINE [
NTNAME,ACCESS,EMPID
AMMS\UK-QLIK-DEV,ADMIN,*
AMMS\UK-QLIK-PRD,ADMIN,*
INDIR-EMP-VIEWER,USER,EMP
INDIR-NONEMP-VIEWER,USER,NONEMP
INFODIR-DEVELOPERS,USER,*
];

Section application;

if i use add 

AMMS\USERID,USER,EMP     -----------When i add individual user ids its working fine when i add ADgroups its giving below error  

data not reloaded    am i missing anything?

[robert_mika]

@Manni_SM 

Is this is your error?(sort of) Security << 7298a757-5fc1-4d35-9210-26f6b896af13 Lines fetched: 5 Access was denied after reload. Check that the user that reloads the script is included in the section access part of the script. Data has not been loaded. Please correct the error and try loading again.

If you are loading the data you need to be included in SA table

[Manni_SM]

Hi @robert_mika  yes all the tables are available and when i add users manually in script its working fine but when i use ADgroups its giving me below error.

[Manni_SM]

Hi @robert_mika  @stevedark  @rubenmarin  @Vegar  @marcus_sommer 

i tried below section acces code its not working as expected  when i add individual user ids its working from when i add ADgroups its not working anything missing?

 ERROR : ACCESS DENIED 

Section access;
Security:
load * Inline [
ACCESS,USERID,ROLE,EMPLY_IND
ADMIN,AS\234728,*,EMP
ADMIN,"CN=INFODIR-US-APP-GCP-PROD-GRNFLD-BCKNDOPS-DEVELOPERS,OU=USQLIKSENSE,OU=AS,OU=APPLICATIONS,OU=GORUPS,DC=INFODIR,DC=PROD,DC=DCB",*,EMP
USER,AS\234729,*,NON-EMP
];

Section application;

TestData:

load * Inline [
EMPLY_IND,AMT
EMP,1000
NON-EMP,2000
];

[marcus_sommer]

I'm not sure but I think this isn't a valid entry for a user-group:

"CN=INFODIR-US-APP-GCP-PROD-GRNFLD-BCKNDOPS-DEVELOPERS,OU=USQLIKSENSE,OU=AS,OU=APPLICATIONS,OU=GORUPS,DC=INFODIR,DC=PROD,DC=DCB"

[Vegar]

I have the same concern as @marcus_sommer 

Make sure that the group name used in Section Access is the same as the group name  you see when looking at the i details for the users in the QMC/Users section.

[Manni_SM]

Hi @marcus_sommer  even i tried with below Adgroups till no luck

if i use below scirpt   only  one Adgroup section acess is working  (*,ADMIN,Infodir-US-App-GCPQlks-preprod-pbus-developers,EMP)   second id group is not working 

Section access;
load * Inline [
USERID,ACCESS,ROLE,EMPLY_IND
ADFS\SENSE_SERVER,ADMIN,*,*
INTERNAL\SA_SCHEDULER,ADMIN,*,*
*,ADMIN,Infodir-US-App-GCPQlks-preprod-pbus-developers,EMP
*,USER,Infodir-US-App-GCPQlks-PreProd-Admins-S-D,NON-EMP
];

Section application;

[marcus_sommer]

Maybe there is any typo. One has for example ... preprod ... and the other ... PreProd ...

[Manni_SM]

tried with upper case all the values but still same issue 

is there any rule that we need to use in order of fileds  like access ,user,role  ? 

and any issue with Adgroups ? 

[marcus_sommer]

The field-order of your examples isn't equally and one is:

ACCESS,USERID,ROLE,EMPLY_IND

and the other:

USERID,ACCESS,ROLE,EMPLY_IND

Beside this I suggest to check again the basic-functionality against users and not groups by specifying different access-rights to EMP and with ADMIN and USER as ACCESS type.