Section Access based on user's custom properties (Qlik Sense)

[Anonymous]

Hi all!

I have created a custom property called GROUP in the qmc, which can either have the value G1 or G2. I have assigned this custom property to my users, some of them have G1, others G2.

My application has a dimension called DIM , which can have the values "A", "B" and "C".

I want to restrict all users who are in GROUP G1 (i.e. have the custom property value G1) to view all data that is connected to DIM values "B" or "C".

I also want to restrict all users who are in G2 to view every data that is connected to "A" or "C".

I have managed to make the section access work by defining the following inline table for each user manually.

section access;

LOAD * inline [

ACCESS, USERID, DIM, OMIT

  USER, DOMAIN1\peter, "A",

  USER, DOMAIN\max, "B",

... ...

];

section application;

But how can I define my behavior by means of Custom Properties?

I have tried this one as shown in the qliksense help page (*) but it gives me "Access denied" to every user:

section access;

LOAD * inline [

ACCESS, USERID, GROUP, DIM, OMIT

  USER, *, G1, "A",

  USER, *, G2, "B",

];

section application;

(*) http://help.qlik.com/en-US/sense/September2017/Subsystems/Hub/Content/Scripting/Security/manage-secu...

[agigliotti · Accepted solution]

you can't use Custom Properties with Section Access.

you can achieve your request using the script below:

Section Access;

LOAD * INLINE [

    ACCESS, USERID, PASSWORD, NTNAME, USERGROUP

    USER, *, *, DOMAIN1\PETER, G1

    USER, *, *, DOMAIN\MAX, G2

  ADMIN, TEST, TEST, *, *

];

Section Application;

LOAD * INLINE [

    USERGROUP, DIM

    G1, B

    G1, C

    G2, A

    G2, C

];

[Anonymous]

Thanks a lot for the quick response!

I dont remember that one has to use PASSWORD and NTNAME in the QlikSense sectionaccess. Aren't they used in QlikView?

What is NTNAME ?

[agigliotti]

Section Access fields are a bit different in Sense.

However NTNAME is the windows domain user account or even the windows local user account.

[MK9885]

Section Access is for Data level security.

QMC security is not.

You'd have to do it manually as you did, associate an NTName (USERID) with a group/value.

What you did originally is correct. There seem to be no other way I know of.

[agigliotti]

please close this thread if you think has been answered.

[thkarner]

I´d say it should be possible.

Within the script you can read custom properties via the REST connector interface.

Then you can modify the read data and put it in the section access table.

Not tested, but 99% sure it would work. I only would recommend to capsule this part in an external QVS script file if users/developers should not be able to get access information of all users.

- Thomas