Active Directory User Groups for Authorization in a QlikView Application

[#1]

I would like to set up an authorization in my QlikView Application using AD groups, which are set up already.

So different user groups have (or not) the authorization to see (and click) on navigation points. With a condition [match(OsUser(),'CORP\ADGroup') ] on a textbox it is definitely possible with single users... but with a AD group? Does anybody have experience with this?

[Gysbert_Wassenaar]

You can use AD groups for setting up authorization using Section Access. You can use that to populate a small table with values and reduce it with section access so members of a group do have access to some values in that table and the other users don't. You can then use that table to drive access (or rather visibility and use) of other objects like text boxes etc.

[adamdavi3s]

If you want to do something directly with the group then you could pull the data into your dashboard from SQL.

Setting up SQL to pull AD data isn't that bad, we do this as I linked AD groups into the governance dashboard template to allow us to map user NTFS access to user Qlik access

http://qlikanddirty.com/2016/08/25/querying-ldap-to-pull-back-people-in-ad-groups/

[Peter_Cammaert]

The difference of this Section Access solution as mentioned by Gysbert with your match technique, is that Section Access will not only try to match usernames with identical SA table entries but will also try to detect group membership of the current user in al possible groups in your Section Access table. This is the perfect solution to your access management challenge. For example, in a Section Access table you can specify entries like (LINKFIELD is an optional reduction field, omit it if you only require access control):

SA:

LOAD * INLINE [

ACCESS, NTNAME, LINKFIELD

ADMIN, CORP\Administrator, *

USER, CORP\UserBob, BOBSREGION

USER, CORP\ADGroup, NORTHREGIONS

USER, CORP\DeptBUsers, SOUTHREGIONS

USER, CORP\QVDEVELOPERS, *

:

];

Two users will get individual access, other users will get access because they are members of groups ADGroup, DeptBUsers or QVDEVELOPERS and everyone else won't even get in.

This externalises the actual access management of a particular QV decoument to Active Directory tools.

Best,

Peter