Data reduction: user sees other user's data

[dafnis14]

Hi,

I have defined data reduction for 2 users.

The issue is that user ZZZZ doesn't see all the data, but  sees the data of user YYYY as well.

Here is my script:

Star is *;

section access;

UserPerms:

LOAD * inline [

ACCESS,USERID,PRODUCTGROUPID

ADMIN, INTERNAL\SA_SCHEDULER,*

];

Concatenate (UserPerms)

LOAD

    ACCESS,

    USERID,

    PRODUCTGROUPID

FROM $(vPathFinalData)UsersPermissions.qvd]

(qvd);

section application;

ItemGroup:

LOAD ItmsGrpCod,

     ItemGroupName,

     ItmsGrpCod as PRODUCTGROUPID

FROM

$(vPathFinalData)ItemGroup.qvd]

(qvd);

Why does it happen?

In a QlikView Desktop, it works as expected. Attached is a model and a users Excel table.

Thanks!

Message was edited by: Dafnis X Added the comparison to QlikView.

[wade12]

see this link (scroll down to dynamic data reduction section):

https://help.qlik.com/en-US/sense/June2018/Subsystems/Hub/Content/Scripting/Security/manage-security...

[dafnis14]

Hi Wade,

I looked there more then once... 🙂

Still can't figure out what I'm doing wrong....

Thanks!

[Lauri]

Are you saying that ZZZZ can see all of YYYY's data? They both have access to ID 2249.

[dafnis14]

Hi Lauri,

Yes. That's exactly what i'm saying...

It's fine that both can see the ID 2249.

As I said, ZZZZ doesn't see all the data (hundreds of product group), but all the data defined in the table.

Thanks!

[Lauri]

So the other hundreds of products groups belong to other users (not YYYY and ZZZZ), and ZZZZ can't see any of them? 

It might be easier if you provide the data.

[dafnis14]

Hi Lauri,

I added the data to the original post. Please note that I've checked it in QlikView and it works as expected:

The database table has hundreds of product groups, but the users see only the product groups which are defined for them in the original Excel.

Thanks so much for your willing to help!

[dafnis14 · Accepted solution]

Hi,

The domain was missing from the permission file.

This caused users to see all the data.

The strange thing is why they were able still able to access the app.

Please note that if a domain is not included in the script:

LOAD * inline [

ACCESS, USERID, REDUCTION

USER, XXX,

];

access is denied!