Locking QVW functionality

[#1]

Hi all -

I'm trying to lock some of the functions of my QVW (reload, script access, new sheet objects, etc... pretty much everything except print and export).  Right now we've got access to the hosted QVW controlled by Active Directory.  I have read the guide to section access and I'm wondering if that's the only way to go about this.  Right now we are not concerned with limiting any of the data, just the functionality.  Is there a way that the only login that users would have to provide in order to see our function-limited QVW would be our current Active Directory login?  Thanks!

[jonathandienst]

Hi

You will need to apply some section access to give USER access to the users. Without section access they get full admin access. Do something like this (where  fFuncGroup is the AD group name)

     Section Access;

     LOAD YourLoginName As NTNAME,    // your login name

          'ADMIN' As ACCESS

     AutoGenerate 1;

     LOAD fFuncGroup As NTNAME,   // functional group name

          'USER' As ACCESS

     AutoGenerate 1;

     Section Application;

Remember to always make a backup of the model before you apply section access, in case you lock yourself out of the document.

HTH

Jonathan

[jonathandienst]

Nearly forgot - once this is working use the Document Properties | Security tab and the Sheet Properties | Security tab to turn off functionality for normal Users. Check the Admin Override Security box to enable full access for yourself.

[#4]

Just talked with a coworker and what they really need to know is how do you denote what *specific* security features a user gets applied to them - I.E Joe gets Admin privileges (full access), Andrea gets generic user privileges (document security settings), but Emily is a super-user so allow her to edit sheet objects and reload the script in addition to the standard document security settings.

[jonathandienst]

No easy way to do this - QV only supports USER (subject to restrictions) and ADMIN (not subject to restrictions) access types. Here are some ideas/issues:

Reloading could be done outside the model by triggering an EDX event (search EDX and QMSEDX here for more information). This could be restricted to superusers.

Bear in mind that everyone gets USER access when loading the document from the portal. This allows the users to create server objects (which they can see, but it does not update the qvw file).

To update the qvw, you need to open the model in a licensed QV desktop. If you use session licensing on the server, and only give named user licenses to the superusers, then the superusers could have USER access, but with few restrictions, or ADMIN access, while normal users would only be able open the model on the portal.

[rwunderlich]

In server access (Access Point), everyone is a "USER". They will not have access to the Script or Reload.

You can control what users have access to Export, Print & new Object Creation function via QMC settings.

"System, Qlikview Servers, Documents. Allow Server Objects" can allow/disallow new sheet objects for all users.

"Documents, Source Documents, Server, Server Objects" can control new Object creation on a per document and per user basis.

In the same tab, "Availability" can control Print & Export to Excel on a document and user basis.

I'm currently looking at at QMC that has Publisher, but I believe those same granular options are available without Publisher.

-Rob

http://masterssummit.com

http://robwunderlich.com