Data modelling issue while implementing confidentiality rule
Hi Team,
I have requirement to hide/dont show Market volume metric data for single customer.Please see below details of data available:
Dimensions:
Customer
Customer Group
Product
Segments
Metrics
Sales
Rank
Market volume
The scenario is I dont want to show market volume when single customer is selected.To handle this at data model level,I ahve created 2 fact table one is at lowest level of customer where I am not taking Market volume metrics rest all metrics are there.
2nd fact table I have data from customer group and remaining dimensions and metrics only Market volume.From this I am able to hide the data of customer market volume when any customer is selected.
Both the fact table and dimensions table where concatenated.
The issue still exist is if we select any particular combination of dmension like segments,product,customer group we landed up with single customer option where data of market volume is visible which i dont want to show or come at qvw.It should be taken care at database level itself.
Can anyone help me on this.
Let me know in case you need any more information.
Here when I select customer market volume will not be shown ,The reason is I have not taken the data of market volume at customer level.This is how i have taken care of customer selection at data model level.
But the issue is when i select the combination of 50P_flag as 'N',Segment as 'Segment2' and trade_type as 'Group' the market volume is showing for single customer.Which breaches my confidentiality rule.I know this can be handle at qlik level by hiding data for possible count of customer as 1.How it can be taken care at data source level?
IMHO the only method to accomplish what you want is to pre-aggregate all market volume data for all possible combinations of dimension values and leave out the individual data from the data source (or data warehouse). This can be done if the range of combinations is not too large. However, I don't think that's the case in your situation.
Compare this to the general problem of a document in which you want to show benchmarking data: any single user can see the aggregated data for any dimension selection, but cannot see de data of individual customers/products/whatever.
The QlikView selection freedom works against your confidentiality requirements. Even when there is actually no risk of a single user ever seeing individual facts.
Two possible solutions:
Stay with your original intent and pre-aggregate the market volume data, but reduce the number of possible selections that can influence the market volume view.
Or leave your original rule, add all detailed market volume data to your application and aggregate in the document according to the many selections that should be possible. Make sure that you hide all objects that display this market volume information whenever the selection/associated value in this one critical field is just 1. Also prohibit end-users from creating their own server objects.
Thank you Peter for your detail explanation.I think of the first solution but the number of possible combination are too high.
The 2nd approach is good to deal it at front end.I will hide the market volume whenever the selection/associated value in this one critical field is just 1.The issue or concern is I am going to share the qvw file with the user to deploy on their environment.Is there any way that they cant see the Market volume data though if they have qvw file?By this I mean to say they cannot create any new report or object .By any means they cant see the market volume due to confidentiality issue?
Please help me on this the best solution where confidentiality remains intact.
Yes you can close down your document so that no-one except you can change objects or create new ones or observe the underlying field values (document level security). The trick is rather simple and uses two modifications:
Create a simple Section Access table with only a few entries for at least one ADMIN and one USER entry for all others. Use the NTNAME identification field for limited login hassle.
Disable all options in the various security tabs (Document-Shaat-Objects) except those needed by ADMIN-role users (you).
In addition to that, you can put your entire load script in a hidden script and protect it by yet again another password.
