Unlock a world of possibilities! Login now and discover the exclusive benefits awaiting you.
Hi All,
Thanks for your reply to my previous post i.e.
https://community.qlik.com/thread/165157
I have gone through server management pdf document and Help section of QMC.
I have few queries regarding Section Access Management as-
Can anyone please assist me on same, as I am new to Section Access and would like it to implement it through QMC and reduce data as per user login.
Thanks & Regards,
MK
One of the (funny) requirements of SA (=Section Access in QlikTech parlance) is that all your field names must be in Capitals. The SA data will be converted to upper case, but if in Section Application you specify link fields in lower case or the data is lower/mixed case, there will be no match.
In Section Application, always name the link field in upper case and specify the field values in that column in upper case as well.
It takes some getting used to, I admit.
Peter
I would suggest to try to implement Section Access first by way of an external file or an INLINE table. Just to get the feel of it before you proceed to QMC-based section access.
Best,
Peter
Thanks a lot for the information Peter.
I have already done a small POC for section access using Hidden script.
But what if, I have a lot of users having different roles coming in .csv file. So, I was just looking into QMC.
Thanks for your reply again.
One more thing, what if I add Two tables in Section Access, one is default and other which has all the settings regarding restriction of Data.
How QMC will behave, whether it will consider union of both tables or ?
That isn't really necessary. You can move the Data reduction settings table to Section application, and still keep it in your Hidden Script if you want.
And for your large number of users problem, it's still preferable to keep the definitions in a file or in a database table. Furthermore, you're talking about roles: that would be an ideal Link field. Imagine the following:
Bob = CEO, should have access to everything
Frank = MGR_EAST, should have access only to Areas from the Eastern region
Bill = Sales Exec, should only see his own stuff
In Section Access you load lines for every QlikView end-user, like:
ACCESS, NTNAME, LINK
USER, BOB, CEO
USER, FRANK, MGREAST
USER, BILL, EXEC1
In Section Application, you define a Link table with LINK-Area pairs, like:
LINK, Area
CEO, Area1
CEO, Area2
CEO, Area3
CEO, Area4
MGREAST, Area2
MGREAST, Area3
EXEC, Area2
Section Access will connect to the LINK field at document-open-time and select the values that should remain. Normal associative behavior will propagate this selection through the whole of your data model. All others will be eliminated
Peter
Sorry, I forgot another of your qestions: what happens with multiple tables in QMC Section Access?
That depends on where you load the data. The Section Access area in QMC is just a handy technique to define administrator-configurable rows (and the only one with a nice web interface). IIRC you don't have to even use these tables in section access. So you can load one table in the Section Access-area of your document, and the other in the Section Application-area. Associations will do the rest.
Peter
Thanks for the detailed analysis Peter.
Our requirement is to implement role based access to Access Point Users.
Idea is, user group will be from Active Directory.
We want to restrict data depending on few field values, few sheets will be hidden and for some users application will not be accessible.
My concern -
1. If we restrict the data, can we do it through QMC
2. If we do it through QMC, whether for each user group there will be number of Apps created
3. Can it be done through Section access Script, if done so, there will be chances, for each user change in Active directory, there will be need to Reload application.
Please assist me on this, regarding, best approach can be used.
Regards,
MK
Some answers that may help you in your decision:
Best,
Peter
I don't get this points
"If you have a SA in your script that uses AD groups instead of user accounts,", what is SA.
I have tried below script -
Section Access;
LOAD * INLINE [
ACCESS, NTNAME
ADMIN, QVADMIN,
USER, *
];
Section Application;
I found that, when the same document is circulated to different user, only QVADMIN user is able to see the section access script.
So, now I try to restrict few data for other users, so i tried this -
Section Access;
LOAD * INLINE [
ACCESS, NTNAME, area_name
ADMIN, QVADMIN, *
USER, *, EAST
];
Section Application;
Where area_name is one of the field in data model. But when I try with other users, though they were not able to see the section access script, but can see all the data irrespective of area.
Is anything is getting wrong in this case.
Another two things-
1> How we can add User group names in the section access script
2> IF NTNAME is used, then whether it will behave in same way on access point as well.
Please assist.
Regards,
MK
Hi gwassenaar
Can you please assist me in this