Section Access Not working for users with limited access (reduced)

[Prateek5]

Hi,

I am trying to implement section access in a qlikview dashboard. My final Section Access Table looks like this:

ACCESS	NTNAME	FIELD
ADMIN	DOMAIN1\USERNAME1	VALUE1
ADMIN	DOMAIN2\USERNAME1	VALUE1
ADMIN	DOMAIN3\USERNAME1	VALUE1
ADMIN	DOMAIN1\USERNAME1	VALUE2
ADMIN	DOMAIN2\USERNAME1	VALUE2
ADMIN	DOMAIN3\USERNAME1	VALUE2
USER	DOMAIN1\USERNAME2	VALUE2
USER	DOMAIN2\USERNAME2	VALUE2
USER	DOMAIN3\USERNAME2	VALUE2

Problem: Those users who have limited access (only to specific value of the Reduction field) are not able to access the dashboard. they get this error when trying to open the Dashboard URL:
Failed to open document, you don't have access to this document.
They don't even see the dashboard on Access Point. 

Those with full access are able to login to the dashboard just fine. I checked the data model and did a lot of tests by commenting out the Section Access; and Section Application; Everything seems fine. 

Any suggestions?

[marcus_sommer]

Both statements below are contrary to each other:

      Failed to open document, you don't have access to this document.

      They don't even see the dashboard on Access Point.

and hinting for different causes.

At first do a check if the app is visible in the access point and could be opened by a user with a planned data-reduction - when the section access is disabled. If the access isn't possible the reason won't be the section access.

If the access is possible then take a further look on the connection between the access table and the link to the normal data-model - pulling the access table into a table-box + some other fields and then selecting users + reduction-values + some others - are there then really valid data in the table-box?

Another look may go to the user-resolution - just add a text-box with: = osuser() to see how the user is identified. Your example data hints for a cross-domain environment which may result different as expected.

[Prateek5]

The users with full access see the dashboard on Access Point and are able to login as well. Those with reduced access don't see the dashboard on Access Point and get the "Failed to open document, you don't have access to this document" error message when asked to go to the dashboard using the URL I shared with them. 

=osuser() shows DOMAIN\username

[marcus_sommer]

Within the document-properties in tab server is in the bottom right a setting to filter the access point in regard to the applied section access. It's a useful extra feature to keep the access point clean as well as preventing any curiosity to content which is confidential.

IMO it should be always enabled. Further disabling won't provide a successful access because the used feature looked into the (xml) header of the app if an section access exists and if the calling user is listed there (it's not related to any data-reduction which comes later during the opening). This means the users aren't listed properly - the slightest difference will lead to a mismatch.

[Prateek5]

Not sure what the recommendation is here. I exported the XML file from File > Export. Can't find any details about the section access there.

[marcus_sommer]

It's not there else you need to open the qvw with an editor like Notepad++ and after a lot of binary content you will at the file-end some xml-stuff. CTRL + F with <SectionAccessNames> will lead you straight to the listed users.

[marcus_sommer]

Just a hint - don't manipulate the file over this way because the risks to end with a corrupt file is quite high. All necessary adjustments should be made within the load and/or through the native settings.

[hugo_andrade]

Hi @Prateek5 ,

Are you able to send the actual section access scritpt?

One troubleshooting step I like to load the section access tables as if they were regular data tables.

See if the tables link correctly to the rest of the data model.