Authorization using a Hierarchy

[hic]

Hierarchies are very common in all database and business intelligence solutions. Often they are used for authorization purposes, i.e. the permissions to see data follows a hierarchy.

One example is an organizational hierarchy. Each manager should obviously have the right to see everything pertaining to their own department, including all its sub-departments. But they should not necessarily have the right to see other departments.

This means that different people will be allowed to see different parts of the organization. The authorization table may look like the following:

In this case, Diane is allowed to see everything pertaining to the CEO and below; Steve is allowed to see the Product organization; and Debbie is allowed to see the Engineering organization only. Hence, this table needs to be matched against sub-trees in the above hierarchy.

Often the hierarchy is stored in an Adjacent Nodes table, and if so, the above problem is easy to solve: Just load the Adjacent nodes table using a HierarchyBelongsTo and name the ancestor field Tree. See the blog post Unbalanced, n-level hierarchies how this is done.

If you want to use Section Access, you need to load an upper case copy of Tree and call this new field PERMISSIONS. Finally, you need to load the authorization table. These two last steps can be done using the following script lines: (The TempTrees table is the table created by the HierarchyBelongsTo.)

Trees:

Load *,

     Upper(Tree) as PERMISSIONS

     Resident TempTrees;

Drop Table TempTrees;

Section Access;

Authorization:

Load ACCESS,

     NTNAME,

     Upper(Permissions) as PERMISSIONS

     From Organization;

Section Application;

When you have done this, you should have a data model that looks like the following:

The red table is in Section Access and is invisible in a real application. Should you want to use the publisher for the reduction, you can reduce right away on the Tree field, without loading the Section Access. In either case, this solution will effectively limit the permissions to only the sub-tree as defined in the authorization table.

But what if you have the hierarchy in a horizontal hierarchy? Then you cannot use the HierarchyBelongsTo.

The solution is not very different from the above one. The only difference is that you need to create the bridging table manually, e.g. by using a loop:

Let vHierarchyDefinition = 'Board level,Director level,Department,Unit';

Let vNumberOfLevels = Len(KeepChar(vHierarchyDefinition,',')) + 1 ;

For vAncestorLevel = 1 to vNumberOfLevels

     Let vAncestor = Subfield(vHierarchyDefinition,',',vAncestorLevel);

     Trees:

     Load distinct

          Upper([$(vAncestor)]) as PERMISSIONS,

          DepartmentID

          Resident [Horizontal Hierarchy]
               Where Len([$(vAncestor)]) > 0;

Next vAncestorLevel

Having done this, you will have the following data model:

Bottom line is that it is fairly straightforward to implement a hierarchical authorization scheme. See more about Hierarchies in the Tech Brief Hierarchies.

HIC

Further reading related to this topic:

A Primer on Section Access

Data Reduction Using Multiple Fields

Tips and tricks for section access in Qlik Sense (2.0+)

[#2]

Is there an example application for this explanation anywhere?

[Anonymous]

hic‌ Great blog, i have just one question, how did we get permission column in authorization table, is that an input we need from user?

[hic]

Yes, you need that table, including "Permissions", as input when you create the document.

HIC

[santoshknc]

Hi All,

Can any of you suggest me the way to implement the Section Access based on the Employee-Manager Table Logic ? When the Employee and Manager are there in the same Table then how can we implement the Section Access Logic ?

Thanks

[Anonymous]

Thanks for the free education

[gagiraldoh]

Can you share the example file please?

[AT]

Very helpful. Thanks.

[Rosario_Aguilar]

Thank you for the information