Issue with Section Access

[vlad_komarov]

I’ve noticed an interesting “feature” in QS Section Access:

1. I have a list of users that have restricted access to one Region each:
   1. ACCESS, USERID, REDUCTION, OMIT
   2. USER, SYSTEM\USER1, CANADA,
   3. USER, SYSTEM\USER2, CHICAGO,
   4. USER, SYSTEM\USER3, MIDWEST,
2. I have few other users that should have a full access to all regions
   1. USER, SYSTEM\USER10,*,
   2. USER, SYSTEM\USER11,*,
3. The problem is users from “All Regions” list (User10 and User11) can see only regions listed for “restricted” users. So both these users can access Canada, Chicago, and Midwest regions, but nothing else (I do have ~30 other regions in the data set).
4. Creating another user (User100) with all available regions explicitly listed gave User10 and User11 access to all other regions.
5. Did I miss anything in the Section access code? Or it’s a “feature” which will be fixed soon?

I will appreciate any suggestions.

Regards,

Vladimir

[maxgro · Accepted solution]

* in section access is for all listed values, not all values

If you search in Qlik help, you can find it, this is an extract

A wildcard, i. e. *, is interpreted as all (listed) values of this field, i.e. a value listed elsewhere in this table. If used in one of the system fields (USERID, PASSWORD, NTNAME or SERIAL) in a table loaded in the access section of the script, it is interpreted as all (also not listed) possible values of this field.

This isn't a bug, it's by design

[JonnyPoole]

Here is dynamic way you could add users to the section access table that are associated with all values. In my case it makes sure that user 'QTSEL\JPE' can see all countries.

section access ;

//load users who can see restricted rows

Security:

load * inline [

ACCESS,USERID,COUNTRY

USER,QTSEL\CANADA,CANADA

USER,QTSEL\OTHER,FRANCE

]

;

//load user who can see all rows

Concatenate (Security)

LOAD distinct

  'USER' as ACCESS,

    'QTSEL\JPE' as USERID,

  upper([countries_world.Name]) as COUNTRY

FROM [lib://Data/Customers.xlsx]

(ooxml, embedded labels, table is Customers);

section Application;

Customers:

LOAD [CustomerID],

  [Address],

  [City],

  [Customer],

  [ContactName],

    [countries_world.Name],

    upper([countries_world.Name]) as COUNTRY,

  [Fax],

  [Phone],

  [PostalCode]

FROM [lib://Data/Customers.xlsx]

(ooxml, embedded labels, table is Customers);

[craigleach]

Vladimir,

This is just the way Section Access functions. If I want the "*" users to have access to the entire dataset. I typically create a "dummy" user in Section Access that has a row for all reduction values.

Regards,

Craig Leach

[vlad_komarov]

Thank you, 

I've found a workaround for this issue (by loading all Regions separately), but I did not realize that it was required by design.

Will remember that now, but just wondering, why it was done this way? I am sure it would be possible to organize the link between all regions without explicitly listing all of them...

Regards,

Vladimir