Can security be implemented in QEMC at Sheet Object Level?

[Anonymous]

I have a requirement that meets the condition in the table below. Users 1 through 6 are assigned a certain zone for data across the dashboard. But for one chart, Chart01, each User (1-6) should be able to access data on all zones. The admins should be able to see data on all zones.

This is what I have done so far:

I have hidden script as below:

Section Access;

LOAD DISTINCT

  Upper(ACCESS),

     Upper(NTNAME) as NTNAME

FROM QMC;

Section Application;

Star is *;

SectionAccesstab:

LOAD Upper(NTNAME) as NTNAME,

     Upper(ZONE1) as %ZONE

From QMC;

ACCESS	NTNAME	ZONE1
USER	USER1	A
USER	USER2	B
USER	USER3	C
USER	USER4	D
USER	USER5	E
USER	USER6	F
ADMIN	USER7	*
ADMIN	USER8	*
ADMIN	USER9	*

mY section access table in QMC looks like this. Note: I put Zone1 on purpose because if i put Zone, that will reduce zone per user to all list boxes and sheet objects in the whole dashboard. Having a different field name allows me to control the reduction at Expression level.

So when I write count(if(field1='13' and %ZONE=ZONE,ID)) in expression for Chart02, the chart will be reduced according to ZONE permission. My strategy is to let Chart01 be un-affected by reduction and I can do that by simply not including %ZONE=ZONE in the expn for this chart01. The problem has been " * " is not reconized as a user having access to data on all zones. The chart goes blank when ADMIN logs in. But when a USER logs in, this method is working and I am able to reduce data at Expression level.

I have hit a wall trying to solve this problem. Please contribute if you can help.

Inorder to make QMC read * as all listed values, i tried creating link table but its not working:--

LinkTable: // I put ALL instead of "*" in QMC sec access table for ADMINS

load distinct

upper(Zone) as %ZONE,

Zone

Resident source table;

load distinct 'ALL' as %ZONE,

              Zone

              resident source table;

[petter]

In QlikView the security is enforced on the data level not on a chart or UI level. Thinking or even trying to mix data access with UI will only make it more complicated. It is what the users and analysts should gain access to from a data perspective that really matters not how or where the data is presented that is important.

Disabling a chart or mangling the expressions really doesn't constitute security - that is what many would call security by obscurity.Your only real security is locking down the data.

[antoniotiman]

Hi,

this should help You

Sheet Security

Regards,

Antonio

[swuehl]

As you said, simply not including %ZONE = ZONE in the expression will solve your problem (giving all ZONEs access).

Alternatively, something like

=count( if( field1='13' and ZONE LIKE %ZONE, ID))

should also do what you want, using * in your SectionAccesstab table.

I noticed that you are trying to use star symbol as as a replacement for all listed values in section application. I believe that semantic is only valid in section access.

See also

Introduction to Section Access

It's also kind of confusing if you name a table 'SectionAccesstab' within section application.

Finally, I believe you are aware of the fact that doing this kind of 'data reduction' in expressions can easily be cancelled by creating e.g. server side objects, so you need to take care of these settings, too. Please have a look at Henric's security overview here:

Data Reduction – Yes, but How?

Finally, please try to avoid duplicate postings with the same topic. It makes it hard to follow a discussion. You could have posted the information above also to the other thread.

[Anonymous]

Swuehl,

Thank you very much for your help. I tried this: I listed all zones in the QMC table under ZONE1: A,B,C,D,E,F for users with " * " access. Then in my section application (hidden script) I wrote:

Star is *;

SectionAccesstab:

LOAD Upper(NTNAME) as NTNAME,

     subfield(Upper(ZONE1),',') as %ZONE

From QMC;

this is making QMC understand that it means all zones listed. This has enabled me to control data reduction at expn level ( by adding "and Zone = %ZONE" to each expression I wish to reduce data) which means I can control what users can see at Object level. So far it seems to work. I will update if it works on the access point for users.

however I also feel this is not the best solution. If you can think of sth that is robust and simpler, please advise.

And also, I 100% agree with you re discussion with duplicate contents. I have left a link at Re: Star is '*' not working in QEMC‌ to direct users to this place and marked that thread assumed answered to minimize confusion & maximize efficiency.

Thank you again.

[Anonymous]

Antonio,

Thanks for your reply. I am not trying to reduce data at sheet level, but at object level. So I have tried sth else. Pls see the posting below and comment if you would like.

Thanks,

D