QlikView section access section application going public into portal

[#1]

Dear gurus,

I'm struggling with following settings. When I do use a section access in an application, it works ONLY if the document is local on my computer or is not transfered through a publisher (direct copy into server, productive path). Then the correct permissions are accepted.

BUT after publishing the document into portal just only following error is shown:

QlikOcx: Failed to open document. You don't have access to this document.

Where did I make a mistake?

Here is a sample coding how did I realize the topic.

Store everything into c:\temp\

And again, thank you very much for any hints in advance.

Here is the script:

ThousandSep='.';
SET DecimalSep=',';
SET MoneyThousandSep='.';
SET MoneyDecimalSep=',';
SET MoneyFormat='#.##0,00 €;-#.##0,00 €';
SET TimeFormat='hh:mm:ss';
SET DateFormat='DD.MM.YYYY';
SET TimestampFormat='DD.MM.YYYY hh:mm:ss[.fff]';
SET MonthNames='Jan;Feb;Mrz;Apr;Mai;Jun;Jul;Aug;Sep;Okt;Nov;Dez';
SET DayNames='Mo;Di;Mi;Do;Fr;Sa;So';
//wegen einer OR Verbindung der Berechtigungsfelder muss eine extra Link-Tabelle erstellt werden
Section Access;
ACCESS:
load USER as NTNAME,//USERID,
ACCESS,upper(G_ANRUFER) & '-' & upper(G_ANGENOMMEN) as AUTH
from $(vCustomizing) (ooxml, embedded labels, table is ROLLE);
Section Application;
STAR IS *;
qualify *;
ANRUFER: //Daten für Gruppenzuordnung der Anrufer
load * , upper(Gruppenname) as ANRUFER
, Gruppenname as Gruppe_Anrufer
from $(vSource)Gruppen.qvd (qvd);
ANGERUFENER: //Daten für Gruppenzuordnung den Angerufenen
load * , upper(Gruppenname) as ANGERUFENER
, Gruppenname as Gruppe_Angerufener
from $(vSource)Gruppen.qvd (qvd);

unqualify *; //Nebenberechnung für eine Link-Tabelle

Security_tmp:
load distinct
//OriginationName & DestinationName as %Connection_Security_KEY,
%Connection_Security_KEY,
OriginationName as ANRUFER.Benutzername,
DestinationName as ANGERUFENER.Benutzername
from $(vSource)Phonecalls.qvd (qvd);

left join load //Verbinden von Gruppen der Anrufer
Benutzername as ANRUFER.Benutzername,
upper(Gruppenname) as ANRUFER
from $(vSource)Gruppen.qvd (qvd);

left join load //Verbinden von Gruppen der Anrufer
Benutzername as ANGERUFENER.Benutzername,
upper(Gruppenname) as ANGERUFENER
from $(vSource)Gruppen.qvd (qvd);

NoConcatenate //Tabellen nicht verbinden
Security:
load
%Connection_Security_KEY, ANRUFER, ANRUFER.Benutzername, ANRUFER & '-' & 'ALLE' as AUTH resident Security_tmp;
Concatenate load
%Connection_Security_KEY, ANRUFER, ANRUFER.Benutzername, 'ALLE' & '-' & 'ALLE' as AUTH resident Security_tmp;
Concatenate load
%Connection_Security_KEY, ANGERUFENER, ANGERUFENER.Benutzername, 'ALLE' & '-' & ANGERUFENER as AUTH resident Security_tmp;
Concatenate load
%Connection_Security_KEY, ANGERUFENER, ANGERUFENER.Benutzername, 'ALLE' & '-' & 'ALLE' as AUTH resident Security_tmp;
drop table Security_tmp; //Aufräumen -> Nebenberechnung für eine Link-Tabelle

unqualify '*','%*';

CallCenter: //Daten Call Center
load * from $(vSource)Phonecalls.qvd (qvd);

[marcus_sommer]

Without section access it worked per server/publisher? If yes then is probably the NTNAME not correct - to check this use a small textbox with osuser() and qvuser().

- Marcus

[jfkinspari]

The serviceuser reloading the document through QMC is perhaps not present in the Section Access, or has limited access.

The service user should have access to all data.

You could try opening the document with the serviceuser, after the document has been reloaded.

[#4]

i had the same problem. try '\\<servername>\temp' instead of 'c:\temp' in $(vSource).

I do not know why but I think QV server has sometimes  a problem with drive-mappings.

[#5]

Thank you guys,

everything is working, if I stay "local" on my machine with my NTNAME and Qlikview Desktop Application.

Server is able to access, if I modify my excel file with line

my NTNAME, role ADMIN, group1 ALLE, group2 ALLE

then each data is shown.

But if I do just want to filter (in / out) some other existing combination, output is just the error message.

my NTNAME, role USER, group1 ALLE, group2 IT -> on server no chance, works only local

my NTNAME, role ADMIN, group1 ALLE, group2 IT -> on server no chance, works only local

my NTNAME, role ADMIN, group1 ALLE, group2 ALLE -> works on server and local

My C:\temp\ is just for the testing purpose - in original our servername is used instead.

Service has granted access from the list as ADMIN to all data. Service user is able to open the document with all data (ADMIN, ALLE, ALLE)

What could it be?

Regards

Stan

[#6 · Accepted solution]

The correct solution is following. In my script just modify this line

ACCESS,upper(G_ANRUFER) & '-' & upper(G_ANGENOMMEN) as AUTH

with

"upper(ACCESS) as ACCESS,

if(upper(G_ANRUFER) & '-' & upper(G_ANGENOMMEN)  = 'ALLE-ALLE',null(),

upper(G_ANRUFER) & '-' & upper(G_ANGENOMMEN) as AUTH"

Michael Jackson would say: This is it.

Regards

Stan