Migrate Apps with Section Access to the Cloud

[Francesco_Xodo]

Hello,

I'm starting to move things from Qlik Sense Client-Managed to Qlik Cloud Analytics through the Qlik Analytics Migration Tool (QAMT) and I got an error message saying "Access denied" when migrating apps with section access. One guy from Qlik told me that the problem is due to the fact that Client-Managed section access uses "USERID" field while Cloud needs "USER.EMAIL" field, so he pointed me to the page Managing data security with Section Access | Qlik Cloud Help and in particular to the section "Managing user access in a multi-cloud environment". Basically the solution would be to have 2 lines for each user, one with the USERID filled and * as USER.EMAIL and the other one with * as USERID and the USER.EMAIL filled. I tried to implement this in one of my apps but it doesn't seem to work. Please find attached a mock up file of the section access I'm using: user "USER_A" is the one used for the migration and should see all the values of the REDUCTION field, so he has * under REDUCTION. User "USER_B" instead should see only value "A1" of REDUCTION field, but now when he opens the Client-Managed app he sees all the values of the REDUCTION field. Does anybody encountered the same problem and found a solution to it?

Thank you

Kind regards

[rubenmarin]

Hi, you can also use ComputerName() or similar functions to detect the environment, ie:

IF ComputerName()='CLIENT-MANAGED_COMPUTER_NAME' THEN
  // Load fields for client-managed
ELSE
  // Load fields for cloud
ENDIF

Or 

IF Len(GetSysAttr('tenantId'))>0 THEN
  // Fields for cloud...

[Francesco_Xodo]

Hello @rubenmarin,

I tried to implement the first solution and it works in the Client-Managed environment, but when I try to migrate the app to the Cloud with QAMT I still get the same error message "Access denied".

Thank you

Kind regards

[Daniele_Purrone]

Ciao @Francesco_Xodo ,

you have a support case open where your user doesn't properly get the email address from the IDP.
I think that would be the cause here: if the user doesn't come it with an email address, section access won't apply.

[Francesco_Xodo]

Hi @Daniele_Purrone,

actually the QAMT runs with user "qlikcloudmig", who has the email address correctly set, so that shouldn't be the problem. Maybe I should map the SAM account name in the sub of the IDP as suggested below, but I don't know how to do it.