Section Access: Not allowing a reload to show all data

[Nicole-Smith]

Hey all,

I'm working on a QlikView dashboard in which I need to apply section access.  I know how to do this, and it's working fine.  The problem that I'm hitting is that anyone with a developer license can open the dashboard, reload it, and then they can see all of the data despite the section access originally reducing it down for them.  The people with developer licenses need to be able to see the dashboard, but not all of them should be able to see all of the data.  I have a few ideas on how to handle this, but I would like to hear how others have solved this issue in the past.

I appreciate any and all ideas.  Thanks in advance!

[Peter_Cammaert]

Access to all data in QV Desktop is only possible because a user has ACCESS=ADMIN. Add all developers except the one that should be able to open and edit the document to your SA table with ACCESS=USER. That's the simple explanation.

There is no solution for allowing Developer access (=being able to change anything in the document & UI & Data model) while at the same time blocking access to the data without using different environments or at least different data sources. For example: a development environment where section access allows any change and all permissions to developers, and a production environment where only the service account has ACCESS=ADMIN. In the latter environment, all production data is loaded, in the former only test data is available.

BTW permissions have nothing to do with licenses. You can close a document to everyone but you, even if they all have a Named CAL or are able to lease a license.

[Nicole-Smith]

I do have the other developers marked as "USER" instead of "ADMIN", and when they open the dashboard, they can only see the data they've been given access to see, but if they open the QVW in QlikView Developer, they can still reload the script (even though they cannot see the hidden script), and after that's done, it shows all of the data (because the data reduction is done on opening, not on the reload finishing).  Is there a setting that I'm missing somewhere that would not allow them to reload?

What I've done to solve for the issue above is check if their username is in my list of admins, and if not, tell them they cannot load the dashboard and exit the script:

IF NOT FIELDINDEX('NTNAME', UPPER(OSUSER())) THEN

     TRACE 'You do not have permission to load this dashboard';

     EXIT SCRIPT

ENDIF

[maxgro]

try to uncheck some flag in

menu --> settings --> document properties --> security

- reload

- partial reload

etc....

check

- admin override security

and makes a backup before

[Peter_Cammaert · Accepted solution]

1. Yes there is. See Settings->Document Properties->Security. If you disable "Allow User Reload" and leave the more general "Reload" checkbox enabled, Users won't be able to reload the document. ADMIN users will always be able to perform a reload. Not that they wouldn't be able to enable the reload checkbox themselves, but that's an extra step that some of them may not like.
2. Good trick. However, this ways users will end-up with an empty document...

Best,

Peter

[Nicole-Smith]

Peter Cammaert wrote:

1. Yes there is. See Settings->Document Properties->Security. If you disable "Allow User Reload" and leave the more general "Reload" checkbox enabled, Users won't be able to reload the document. ADMIN users will always be able to perform a reload. Not that they wouldn't be able to enable the reload checkbox themselves, but that's an extra step that some of them may not like.

It's not secure enough if they can check the box and then run it.  If there was a way to disable their ability to recheck this box, that would work perfectly.

Peter Cammaert wrote:

   2.  Good trick. However, this ways users will end-up with an empty document...

Yes, which means they will need to go look at the one available on AccessPoint where they will only be able to see the data after it has already been reduced.  There is no reason these other developers should need to reload or even open the dashboard within QlikView Developer.  But since they have licenses, there is nothing stopping them from doing so since they have access to where the document is stored.

[swuehl]

Nicole Smith <span class="icon-status-icon icon-mvp" title="Mvp"></span> wrote:

It's not secure enough if they can check the box and then run it.  If there was a way to disable their ability to recheck this box, that would work perfectly.

Why not uncheck 'Access Document Properties (Users)' then?

[Nicole-Smith]

That's what was missing swuehl‌, thank you!