Skip to main content
Announcements
Have questions about Qlik Connect? Join us live on April 10th, at 11 AM ET: SIGN UP NOW
cancel
Showing results for 
Search instead for 
Did you mean: 
Anonymous
Not applicable

Section Access Question

Hi folks

I'm trying to test a number of facets of Section Access and have found it to be a bit buggy. I'm trying to allow for all values within the reduction column (Client) to be returned. If I specify a Client value that I know is in my dataset it returns records appropriately. If I use the *, I get access is denied errors.

Below is my Section access table:

SECTION ACCESS;

LOAD * INLINE [

    ACCESS , USERID, CLIENT

    USER, AD\USER1, *

];

I'm using a SQL query for my report data:

LOAD *;

SQL SELECT ID

  , UPPER(PROCESSUSER) AS USERNAME

  , UPPER(CLIENTNAME) AS CLIENT

FROM Table1

Please note, I didn't want Section Access to match on the UserID as I only want to reduce on the Client field.

If I add another user to my Section Access i.e.

SECTION ACCESS;

LOAD * INLINE [

    ACCESS , USERID, CLIENT

    USER, AD\USER1, *

    USER, AD\USER2, CLIENT1

];

The app will give me access and will return all records for Client1.

I don't understand why it would give me access when I add a second user or reduce the dataset simply because one user has this value in their reduction.

I was of the understanding that using the * in the reduction will return all values for this value.

If I do alter the report data set to use USERID instead of USERNAME i.e. allowing Section Access to authorize against the login name, keep the * in the reduction field and remove the second user, I get Access Is Denied again.

If I put Client1 as the value in the reduction field, I can access the report with the report reduced correctly.

Can someone explain Qlik's behaviour here as it doesn't appear to be consistent. I was working under the assumption that using a * in the reduction field will allow for all values in the report data set. Is this correct?

1 Solution

Accepted Solutions
Anonymous
Not applicable
Author

I've put together the following sample data:

STAR IS *;

Section Access;

LOAD ACCESS, USERID, LOCATION, CLIENT INLINE [

    ACCESS , USERID, LOCATION, CLIENT

    USER, AD\USER1, DUB, STARK

    USER, AD\USER2 DUB, *

];

Section Application;

TestData:

LOAD ID, USERID, CLIENT, LOCATION INLINE [

    ID , USERID, CLIENT, LOCATION

    1, AD\USER2, STARK, DUB

    2, AD\USER2, LANNISTER, DUB

    3, AD\USER2, TYRELL, CUR

    4, AD\USER1, STARK, DUB

    5, AD\USER1, GREYJOY, COR

    6, AD\USER2, BOLTON, CUR

    7, AD\USER1, MARTELL, COR

    8, AD\USER1, BARATHEON, CUR

];

Using * would appear to return only those available values in Section Access NOT the report data i.e. Stark is the only available Client value in Section Access, therefore return only this Client value where the UserID and Location also exist. This is why when I just have one record in Section Access with a * for the reduction, there are no other available values to authenticate against, hence the reason why I get Access Is Denied messages.

View solution in original post

5 Replies
MK9885
Master II
Master II

STAR is *;

SECTION Access;

Data:

LOAD * INLINE [

    ACCESS , USERID, CLIENT

    USER, AD\USER1, *

];

SQLTABLE:

LOAD *;

SQL SELECT ID

  , UPPER(PROCESSUSER) AS USERNAME

  , UPPER(CLIENTNAME) AS CLIENT

FROM Table1;

SECTION Application;

Note: Here Star is * means that particular user will have access to all data, as an admin. If you want to reduce the data then

Data:

LOAD * INLINE [

    ACCESS , USERID, CLIENT

    USER, AD\USER1, Client1

    ADMIN, AD\USER2,*

];

SQLTABLE:

LOAD *;

SQL SELECT ID

  , UPPER(PROCESSUSER) AS USERNAME

  , UPPER(CLIENTNAME) AS CLIENT

FROM Table1;

SECTION Application;

The AD\USER2 will have admin access and AD/USER1 will be only limited to Client1 Data

Anonymous
Not applicable
Author

Thanks for the response Aehman

I tried what you suggestions and got the following behaviour

1. I still got Access Is Denied when I tried using Star Is *

2. When adding a second user in the Section Access, the user with * in the Entity reduction still returns only the values for the reduction value for the other user.

If I get time, I'll build some inline tables with some dummy report data to test this against further, that way it might be easier for us to diagnose this behaviour.

Anonymous
Not applicable
Author

I've put together the following sample data:

STAR IS *;

Section Access;

LOAD ACCESS, USERID, LOCATION, CLIENT INLINE [

    ACCESS , USERID, LOCATION, CLIENT

    USER, AD\USER1, DUB, STARK

    USER, AD\USER2 DUB, *

];

Section Application;

TestData:

LOAD ID, USERID, CLIENT, LOCATION INLINE [

    ID , USERID, CLIENT, LOCATION

    1, AD\USER2, STARK, DUB

    2, AD\USER2, LANNISTER, DUB

    3, AD\USER2, TYRELL, CUR

    4, AD\USER1, STARK, DUB

    5, AD\USER1, GREYJOY, COR

    6, AD\USER2, BOLTON, CUR

    7, AD\USER1, MARTELL, COR

    8, AD\USER1, BARATHEON, CUR

];

Using * would appear to return only those available values in Section Access NOT the report data i.e. Stark is the only available Client value in Section Access, therefore return only this Client value where the UserID and Location also exist. This is why when I just have one record in Section Access with a * for the reduction, there are no other available values to authenticate against, hence the reason why I get Access Is Denied messages.

MK9885
Master II
Master II

Find the attachment.

The Script should be

Star is *;

Section Access;

LOAD * INLINE [

    ACCESS, USERID, LOCATION, CLIENT

    ACCESS, USERID, LOCATION, CLIENT

    USER, AD\USER1, DUB, STARK

    USER, AD\USER2 DUB, *, *

    ADMIN, AD\ADMIN, *, *

];

LOAD * INLINE [

    ID, USERID, CLIENT, LOCATION

    ID, USERID, CLIENT, LOCATION

    1, AD\USER2, STARK, DUB

    2, AD\USER2, LANNISTER, DUB

    3, AD\USER2, TYRELL, CUR

    4, AD\USER1, STARK, DUB

    5, AD\USER1, GREYJOY, COR

    6, AD\USER2, BOLTON, CUR

    7, AD\USER1, MARTELL, COR

    8, AD\USER1, BARATHEON, CUR

];

Section Application;

And to test if your Section Access is working, I added

Test:

LOAD * INLINE [

    ACCESS, USERID, LOCATION, CLIENT

    ACCESS, USERID, LOCATION, CLIENT

    USER, AD\USER1, DUB, STARK

    USER, AD\USER2 DUB, *, *

    ADMIN, AD\ADMIN, *, *

];

Here Admin will have full access and user will have reduced access as per fields you've given and by NTNAME.

When you use Star is *;

In table viewer you'll see the value as 'Total' for him (which means this user has full access).

Try it and let me know.

Thanks.

MK9885
Master II
Master II

I didn't know you were working on Qlik Sense, anyway the script will be same but you can test it on Server, not on Desktop.