Solved: Problem with section acces and OMIT - Qlik Community

Report Inappropriate Content · ‎2011-11-29

Hello everybody,

In my application, i want to do security in 2 levels:

- for object (display or not)

- for fields (all acces or not access)

The security on the object is ok with my script but the problem is the security for fields.

I want that not all users can see all fiels.

For exemple group RH don't have the right to see MONTANT_COMMANDE

I have this script:

section access;

LOAD * inline

[ACCESS NTNAME GROUPE

ADMIN, ADMIN, *

ADMIN, User1, RH

USER, User2, RH

USER, User3, RH

USER, User4, AFFAIRES];

section application;
star is *;

SET VAR_AFFICHAGE = 0;

LOAD * INLINE

[GROUPE VAR_AFFICHAGE OBJET_ID

TOUS, * ,objet0

RH, 1 ,TX71

RH, 1 ,TX69

AFFAIRES, 1, TX70

AFFAIRES, 1 ,TX68];

LOAD * INLINE
[GROUPE OMIT

RH, AFF_MONTANT_COMMANDE

RH, IND_TEL_PRO_MOBILE];

My 2 fields AFF_MONTANT_COMMANDE and IND_TEL_PRO_MOBILE are defined in the script.

Where is the problem with my OMIT script?

Why when I'm connect with User2 I see the 2 fields in the OMIT.

Have you any idea??

thank you for your help...

Miguel_Angel_Baeyens · ‎2011-12-01

Hi Hélène,

Check the application attached. It's quite simple, but you will get the idea. In the application, there are the following users:

ADMIN will see everything: Sales, Margin and Profit, for USA and ES
USER1 will see everythin but only from USA
USER2 will see only Sales and Profit, not Margin, only from USA
USER3 will see USA and ES, but only Sales, not Margin nor Profit (you need two rows one for each field the user cannot see, and the COUNTRY value is blank meaning all)

Password for each user is the same as user (ADMIN, USER1 and so). From this on, the combinations may be anything, but one value means one row for every user.

Hope that helps.

Miguel

View solution in original post

Miguel_Angel_Baeyens · ‎2011-11-29

Hi,

OMIT field must be in the section access table, and means that the fields listed under are removed from the data model for that user. You are using OMIT out of the section access table, although linked, and this is why it's not working.

Hope that helps.

Miguel

Report Inappropriate Content · ‎2011-11-30

Hi,

Thank you for your help.

I tried what you said but it's not ok...

Have you any idea???

Thank you for help

Report Inappropriate Content · ‎2011-11-30

With the Miguel Solution's, i have succeded with OMIT with this script :

section access;

LOAD * inline

[ACCESS NTNAME GROUPE,OMIT

ADMIN, ADMIN, *

ADMIN, User1, RH, CHAMP1

USER, User2, RH,CHAMP1

USER, User3, RH, CHAMP1

USER, User4, AFFAIRES,CHAMP2];

section application;
star is *;

SET VAR_AFFICHAGE = 0;

LOAD * INLINE

[GROUPE VAR_AFFICHAGE OBJET_ID

TOUS, * ,objet0

RH, 1 ,TX71

RH, 1 ,TX69

AFFAIRES, 1, TX70

AFFAIRES, 1 ,TX68];

But i have a question, why a can't do an other table for OMIT like this:

section access;

LOAD * inline

[ACCESS NTNAME GROUPE,OMIT

ADMIN, ADMIN, *

ADMIN, User1, RH, GP1

USER, User2, RH,GP1

USER, User3, RH, GP1

USER, User4, AFFAIRES,GP2];

LOAD * inline

[OMIT , CHAMP

GP1 , CHAMP1

GP1, CHAMP2

GP2,CHAMP1];

section application;
star is *;

This script it's not working???have you any idea for this script working?

Thank you for your help

Report Inappropriate Content · ‎2011-11-30

Hi,

Nobody have a idea for my problem???

Miguel_Angel_Baeyens · ‎2011-11-30

Hi,

OMIT is a key field name, as it is NTNAME or USERID or ACCESS and is only loaded and accessed by section access, meaning that will not be available once the script has finished (actually, you can do Ctrl + T to see your tables and you will never see the Section Access table).

What you can do instead is to use a reduction field, that is, a field that does exist in your data model (your are actually using GROUPE).

In short, if you want to omit several fields for each user, you will have to write several lines for that user in section access instead of grouping. Note that "*" in section access, when used in a client - server environment does not mean "all values", but "all listed values" for that field only in the section access table. So if you now add a new user, say User5 and want to get both GP1 and GP2 fields in OMIT, use the "*".

Hope that helps.

Miguel

Report Inappropriate Content · ‎2011-12-01

Hi Miguel,

Thank you for your response and your help...

I not find exemple with REDUCTION.

Can you have any exemple please?

How use the reduction field??

Thank you for your help...

Have a nice day

Hélène

Report Inappropriate Content · ‎2011-12-01

I think the problem is in user preference settings, try this:

1. Go to user preference -> opening -> tick " initial data reduction based on section acces" and also " prohibit binary load".

2.On every sheet go to properties -> general -> conditional and apply:

=sum(SHEET NO.)>=1

I am also attaching my section access sheet, take help from that.

Report Inappropriate Content · ‎2011-12-01

Thank Vijit,

Your script it's ok for object, sheet...

But my problem is for field...

How met security on fiel with omit and use group???

have you any idea?

Thank a lot

Report Inappropriate Content · ‎2011-12-01

here is the script for field restriction:

Section Access;

LOAD * INLINE [

ACCESS, USERID,PASSWORD,NUM,OMIT

ADMIN, Y,password,*,

USER, X,password,2,EXT

];

Section Application;

Load table here.

here EXT is the field name which is restricted for user X.

User X can only see data associated with NUM=2.