Section Access prohibits data even after removed from data load editor

[liam_hanninen]

I've placed section access at the beginning of my script

section access;

load * inline [

ACCESS, USERID

USER, OURCO\user1

];

And in the following section I initiate the actual data loading with:

Section Application;

If I change user1 to user1234qsc I receive 'Permission Denied' which is what I wanted. - Awesome.

And then I change it back to user1 so I have access.

I notice two things

1. I do not get 'Permission Denied' which is expected (I am user1) - Awesome again
2. No data is loaded - even after reloading it -Not awesome

#2 is the issue.  Now that I know section access is working I no longer see data. For a sanity check I remove all section access code and reload. But still no data!

I'm not concerned about retrieving the app since it is a duplicate but I obviously want to know how to provide not just the permission but also the data too! haha. And I would like to know why the data is being restricted even now that section access is gone from the script.

[MK9885]

post a screenshot of your script?

You can do Section Access anywhere you like but I don't know if we can place it before anything else.

You doing binary load along with Section or just Section Access?

Maybe just place the Section Access script in the last tab of script?

[liam_hanninen]

Thanks for the idea but no luck placing it at the end. Also, it is impractical to send a screenshot of my entire script (there are 10 sections and many lines). But the script successfully loaded data prior to loading it with section access. And then after section access - even when I have permission - it fails to load the data.

[MK9885 · Accepted solution]

Ok...

section access;

load * inline [

ACCESS, USERID

USER, OURCO\user1

];

And in the following section I initiate the actual data loading with:

Section Application;

What's actually after your inline load? you loading just one table or taking whole script containing 10 tabs in Section Access?

Usually it is only the table with a field which you want to restrict users.

Ex:

section access;

load * inline [

ACCESS, USERID

USER, OURCO\user1

];

Data:

Upper(RESTRICTFIELD) as RESTRICTFIELD,

Upper(ACCESS) as ACCESS,

Upper(USERID) as USERID;

From....

Section Application;

Which field are you restricting users? There is no such field in your Inline load and also not that you'll need a Service Account to run this file in QMC. W/O Service Ac the task will fail and add Service Ac to inline load as an Admin.

Place SA script in last tab and

Start is *;

then follow your script..

Here the * means full access to data, so Admins should have * in their restricted field and users should have field you want to restrict.

And if you not doing through DB then you can do an Inline load too to restrict

Check out for different examples on Section Access through Inline load. Don't add too many tables to Section Access.

Just 1 is enough along with and use Inline (if not doing Section through DB).

[liam_hanninen]

Thanks. I tried putting it at the end of the script and adding RESTRICTFIELD.

section access;

load * inline [

ACCESS, USERID, RESTRICTFIELD

USER, OURCO\user1, OfficeName

];

And I also tried putting a table inbetten the section access statement and the Section Application statement. Still no luck.

Can you clarify a few things? What did you mean "...and also not (I assume you meant 'note') that you'll need a Service Account to run this file in QMC".  Do I have to do something in the QMC separately to load the data? Again maybe I missing something very basic about Section access.

[MK9885]

Yes, to run this you'll need to add Service Account also in your Section Access Script.

Ex:

section access;

load * inline [

ACCESS, USERID

USER, OURCO\user1

ADMIN,OURCO\SERVICEACCOUNT

];

Check the below link

Section Access Question

If you not sure about service account, ask your infrastructure team about it's NTNAME or username. and add it to inline when running in QMC.

[liam_hanninen]

Thanks so much. I circled back to this previous answer which helped me better understand using section access and targeted areas instead of the whole app. The issue was a combination of things such as placement of it the statements and what my headers for the section access script was. Note 'OMIT' is used as the header for restricted field names for Qlik Sense.