Alternatives to Section Access

[Ormesome]

I have a series of reports to deliver.

Section Access worries me for several reasons:

• a reload is required to apply changes to the security
• users still see the app even if they do not have permission to open it
• it's possible to lock yourself, the developer, out of the app

I can put reports into spaces and apply security on spaces instead of using section access. This should alleviate all 3 of my concerns. As a new to Qlik developer I'm looking to solve the following things without using section access:

• access to spaces based on active directory group or attribute of the account
• filtering of rows or columns based on active directory group or attribute of the account

Maybe I'm not looking at the right blogs or training materials. Can anyone point me at the right resources?

[tresesco]

For row filtering (or, row-level data security) you would need Section Access. And for the overall access security and governance you would need Space access control. So, it's a combination of both.

[Ormesome · Accepted solution]

Sometimes you just don't know where to look. The resources I was after:

Setting up an IDP for importing users and groups

• How To: Configure Qlik Sense Enterprise SaaS to us... - Qlik Community - 1704442

Managing permissions for share spaces

• Managing permissions in shared spaces | Qlik Cloud Help

Managing permissions for apps

• Sharing apps with users who are not space members | Qlik Cloud Help

Managing data access with section access

• Managing data security with Section Access | Qlik Cloud Help

A summary

• Use IDP (in my case, Active Directory) to control who can log into Qlik
• It can get tedious managing lots of spaces with similar data models. Create one space with one data model (or at least keep the number low).
• In that space, create lots of apps with their own sheets and visuals. Assign groups (use the AD group names) to apps rather than spaces.
• If you must use section access, link it to an external list so that you can edit it to put yourself back in when you inevitably mess it up. Use groups.
• In all these places it is possible to use group names instead of usernames. This will make maintenance and auditing much easier.