Qlik Community

Ask a Question

Qlik Design Blog

All about product and Qlik solutions: scripting, data modeling, visual design, extensions, best practices, etc.

Announcements
QlikWorld Online 2021, May 10-12: Our Free, Virtual, Global Event REGISTER TODAY
Henric_Cronström

Section Access is a QlikView feature that is used to control the security of an application. It is basically a part of the load script where you can define an authorization table, i.e. a table where you define who gets to see what. QlikView uses this information to reduce data to the appropriate scope when the user opens the application.

This function is sometimes referred to as Dynamic Data Reduction, as opposed to the loop-and-reduce of the Publisher, which is referred to as Static Data Reduction.

 

Data Model.png

 

For example, above you have the authorization table in Section Access to the left, linking to the field COUNTRY. (In a real application, the authorization table is not visible in the data model.) This means that when a user opens the application, QlikView uses the user name (NTNAME) to establish which countries this user is allowed to see, and then makes the corresponding selection in the Customers table.

The selection propagates to all the other tables in the standard QlikView manner, so that the appropriate records in all tables are excluded, whereupon QlikView reduces the scope for this user to only the possible records. This way, the user will only see data pertaining to the countries to which he is associated.

 

Selection.png

 

A good way to debug your Section Access is to temporarily remove the Section Access statement and run the script. The authorization table will then be visible in the data model and you can make selections in NTNAME.

Within Section Access you should define at least three fields: ACCESS, NTNAME and a third reducing field that links the authorization table with the real data. You may have additional fields also, like user roles or departments.

 

Some points around Section Access:

  • All fields in Section Access must be upper case. Hence, the reducing field must be in upper case also in the data. Use the Upper() function and name the fields in upper case.
  • Don’t use the fields USERID and PASSWORD, unless it is for testing or debugging. Proper authentication is achieved through NTNAME.
  • NTNAME is the field used to match an authenticated user – also if you set up ticketing using other authentication mechanisms than Windows integrated security.
  • NTNAME may contain names of groups as well as individual users.
  • Make sure "Initial Data Reduction..." and "Strict Exclusion" are checked (Document properties - Opening). If the field value of the reducing field in Section Access doesn't exist in the real data, the will be no data reduction unless Strict Exclusion is used.
  • If your users work off-line, i.e. download the physical qvw file, the security offered by Section Access has limited value: It does keep honest people honest, but it will not prevent a malicious user from seeing data which he shouldn't have access to, since the file is not encrypted. So for off-line usage I instead recommend the static data reduction offered by the Publisher, so that no files contain data the user isn't allowed to see.
  • In most of our examples, an inline Load is used in Section Access. This is of course not a good place to keep an authorization table. Store it in a database and load it using a SELECT statement instead!

 

And finally

  • Always save a backup copy when making changes to Section Access. It is easy to lock yourself out...

 

Section Access is a good, manageable and flexible way of allowing different access scopes within one document. And when used on a server, it is a secure authorization method.

 

HIC

 

Further posts related to this topic:

Data Reduction – Yes, but How?
Data Reduction Using Multiple Fields
Tips and tricks for section access in Qlik Sense (2.0+)
https://youtu.be/ObuetXgk2R8

42 Comments
Henric_Cronström

You need to create an authorization key that contains both the employee id:s and the customer id:s. Your requirement is really to use the union between the two possible ways to reduce data. See more on

Generic keys and Basics for complex authorization

HIC

500 Views
Not applicable

‌Hic,

Great blog, its really helped.

Any suggestions on how to use section access across an Enterprise level implamentation of Qlik?

I'm investigating how to use Section Access to control multiple QVW's across 51 countries (as simply as possible) without the need for hunderds of excel files

AD groups are being used to control access to each QVW, but there is a requirement to reduce the data. So Section Access looks to be the best way forward, providing it doesnt have a massive cost to maintain.

Thanks, Si

0 Likes
500 Views
Henric_Cronström

If you have a reducing field that appears in multiple apps, e.g. Region, you can use the same Section Access for all these apps. Store this table in a database or in a central Excel file, and it will be easy to manage.

Further, to base it on AD groups sounds like an excellent idea.

HIC

0 Likes
500 Views
Not applicable

HI Henric,

Thanks for nice blog.We have one Top customers Dashboard for LA countries (South American Countries).

We have maintained section access with Country , NTNAME & access.

We created separate dashboard for APAC region and maintained user list in same excel but after moving these changes to prod.LA dashboard was getting hanged upon selection of country and APAC dashboard was working fine.

We were using same section access excel file for different QVWs.One for ASIA and other for  LA region.

I am not sure why we are facing this issue.Can you please suggest on this.

0 Likes
500 Views
Henric_Cronström

You probably have changed something so that the LA dashboard stopped working. However, it is not possible for me to assess what it could be without seeing the data. I suggest you open a thread of its own in the forum and post the script and a sample of the xls file.

HIC

0 Likes
500 Views
wgonzalez
Partner
Partner

Hi,

I'm having issues with my implementation of Section Access.  It is performing an unwanted data reduction.  In the Presentation qvw, it is reducing by Function field which is not intended.   It it doing this even though I'm in the SA table with ADMIN access.  The reduction field is SUPVID.  Please see table and attached image.

ACCESSUSERIDPASSWORDNTADMINACCOUNTSUPVID
ADMIN**AM\ADMIN1*
ADMIN**AM\ADMIN2*
ADMIN**AM\ADMIN3*
     
ACCESSUSERIDPASSWORDNTACCOUNTSUPVID
USER**AM\USER112345
USER**AM\USER267890
USER**AM\USER324681
USER**AM\USER4*

 

Data model, data reduction should be by SUPVID.Data model, data reduction should be by SUPVID.

0 Likes
171 Views