Qlik Sense Restrict Access to Expression Editor?

[danielgargiulo]

We are just trying to restrict the self-service functionality in Qlik Sense so a user can only create new charts and tables with the master measures and dimensions. The problem is in Edit mode a user has access to the ‘expression editor’ which gives access to all the fields in the data model, including hidden fields. Does anyone know a way to restrict this functionality?

[oli_hardy]

Hi Daniel

Did you find a way to achieve this? Or how do you handle this with your customer in a self-service environment?

Regards Oliver

[Digvijay_Singh]

We are also on the same boat and looking to hide certain fields completely even with no access to anywhere including expression editor in custom/private user sheets?

Any ideas please!

@tresesco  @rwunderlich  @stevedark 

[stevedark]

This is not something that I have tried to do. As far as I am aware even if you try and obfuscate the field name and hide it (with HidePrefix) a user will still be able to unlink a Master Measure and see the code behind it and work out what was going on.

Using variables (which are not so easy to get to without having an app in your work stream) can help obfuscate things a bit further, but someone with a bit of knowledge could find the content of a variable by having an expression to get the code of the variable in a string (e.g. '$(vObfuscatedCode)').

Hopefully someone else will have some ideas.

Steve

[Digvijay_Singh]

Thanks! @stevedark for checking on this.

Thinking of using Hash functions to convert the IDs into the different unique values before they get loaded in the QVDs. AFAIK Autonumber is not helpful when a single field is sourced from multiple QVD creation apps. We are still thinking about all the options/limitations.

[tresesco]

Check if section access OMIT could be applicable here. 

[Digvijay_Singh]

Thanks @Tresesco or checking on this! These ID fields are used in the aggregation measures and acting as keys as well, as I understand OMIT takes the field out of the data model so I think that would impact the metrics and the associations. 

[tresesco]

I didn't play around much with OMIT earlier. Now when try few things in qlikview, I see this doesn't work (visible as if no omit is there) for key fields. And also, the qlik help says that 'omitted fields are visible in the data model' which I could not replicate using a non-key field in omit structure. Quite surprising! or may be I need to do bit more rigorous testing on it (when I have more time).

As an alternative, I can think of another not-so-easy solution, again using section access; instead of hiding the field itself, hide all the values in it and show 'nothing' or any dummy value in it. However, this again might not work if you are actually using this field in calculations (i.e. - if you have a case where you want to show the sum of 100,200,300 =600 and don't want to show these values as field values).

[oli_hardy]

To use OMIT to achieve the restriction as desired for the self-service functionality is not the right approach. With OMIT the field is not only not anymore visible to the user, but also the content is not anymore available to the users.

In my opinion there are no good workarounds available to fulfil this requirement of not showing the fields to all users with a professional license. 

It should be done on security rule level within the QMC. The ability to restrict the area of access to users only to the masterelements and the ability to restrict the "unlink" option of the masterelements should be possible. Or to restrict to go into the FX-Editor in general for some users. That something Qlik should provide.

[stevedark]

Hi @oli_hardy 

That was my thoughts also, I was interested to see if anyone knew better. The level of flexibility in Sense Client Managed security is massive - but it doesn't go as far as this. Locking down to Master Items only, with no ability to edit measures or see data model would be very useful.

Maybe something to raise in the Ideation section of Community, and then post a link back here to get some traction for it?

Steve