Reduction field in section access

[NickP_DF]

Hi guys,

I'd like that a user shouldn't be able to see the S or T order types (the other users must see everything), so that I create a section access like that:

Section Access;
LOAD * INLINE [
ACCESS, USERID, PASSWORD, ID, ACCESSORDERTYPE
ADMIN, ADMIN, xxx, 0,
ADMIN, BOB, yyy, 1,
ADMIN, JOHN, aaa, 1
USER, MIKE, hhh, 2, S
USER, PAUL, zzz, 2,
USER, LAURA, ttt, 2
];

Section Application;

AccessGroups:

LOAD * INLINE [

ID, GROUP
0, ADMINISTRATORS
1, PRODUCTION
2, FABRIC
];

In this way, it works properly for the users ADMIN, BOB, JOHN (who see everything), the user MIKE sees only "S" order type and the users PAUL and LAURA get the error "The document...failed to load" 🙄

Besides that, If I add a line to above the MIKE user to avoid him to see the S and the T order types:

...

USER, MIKE, hhh, 2, S
USER, MIKE, hhh, 2, T

...

it works properly for the users ADMIN, BOB, JOHN (who see everything, like in the previous version), and the users MIKE, PAUL and LAURA get the error "The document...failed to load."

What's wrong with my script?

Thank you so much.

N.

[Or]

For starters, your script doesn't actually give PAUL and LAURA any permissions because you left ACCESSORDERTYPE null. You should be using * for "Everything" (excluding nulls, but you should generally avoid the use of section access on fields with nulls), which may also require a * is star statement.

Since you are using multiple fields for your section access, it'd be best to start with this:

https://community.qlik.com/t5/Qlik-Design-Blog/Basics-for-complex-authorization/ba-p/1465872

[NickP_DF]

Hi,

thank you for your answer 🙂

I've read your reply and the documentation you suggested and I've changed my script as: 

Section Access;
LOAD * INLINE [
ACCESS, USERID, PASSWORD, ID, ACCESSORDERTYPE
ADMIN, ADMIN, xxx, 0,
ADMIN, BOB, yyy, 1,
ADMIN, JOHN, aaa, 1,
USER, MIKE, hhh, 2, S
USER, MIKE, hhh, 2, T
USER, LAURA, ttt, 2, *
];

Section Application;

AccessGroups:

LOAD * INLINE [

ID, GROUP
0, ADMINISTRATORS
1, PRODUCTION
2, FABRIC
];

The results are:
- the ADMIN users account log in and see all the order types, as I wish
- MIKE user logs in, but he can see only the 'S' order types (not also the 'T' as I wish)
- LAURA user logs in, but he can see only the 'S' order types (not ALL the order types as I wish)  

Pls. note that LAURA behavior is what I expected since I've read in the documentation that the "*" grants all the reduction listed in section access, but I'd like her to be allowed to all the order types (from 'A' to 'Z')

Thanks.

N.

[NickP_DF]

....So I've made a step ahead and now I'm able to allow multiple values to MIKE

Section Access;
LOAD * INLINE [
ACCESS, USERID, PASSWORD, ID, TIPOORDINELIM
ADMIN, ADMIN, xxx, 0,
ADMIN, BOB, yyy, 1,
ADMIN, JOHN, aaa, 1
USER, MIKE, hhh, 2, LIMITATO
USER, LAURA, ttt, 2, ALL
];

Section Application;

AccessGroups:

LOAD * INLINE [

ID, GRUPPO
0, ADMINISTRATORS
1, PRODUCTION
2, FABRIC
];

OrderTypeLimitations:

LOAD * INLINE [

TIPOORDINELIM, TipoOrdVendita
LIMITATO, S
LIMITATO, T
];

The results are:
- the ADMIN users account log in and see all the order types, as I wish
- MIKE user logs in, and he can see only the 'S' and the 'T' order types, as I wish

I'm not able to allow LAURA to see ALL the order types as I wish: I wouldn't like to list in the OrderTypeLimitations table all the rows:
ALL, A
ALL, B
ALL, C

...

ALL, Z

because if they'll implement a new Order Type in the future (such as '$', for example), LAURA won't be able to see it without my intervention in the section access code).

Thank for the help.

N.

[hic · Accepted solution]

Yes, it is possible. One way to do it is along the following lines:

Section Access;
LOAD * INLINE [
ACCESS, USERID, PASSWORD, ID, TIPOORDINELIM
ADMIN, ADMIN, xxx, 0, <ALL>
ADMIN, BOB, yyy, 1, <ALL>
ADMIN, JOHN, aaa, 1, <ALL>
USER, MIKE, hhh, 2, LIMITATO
USER, LAURA, ttt, 2, <ALL>
];

Section Application;
OrderTypeLimitations:
Load distinct
'<ALL>' as TIPOORDINELIM,
TipoOrdVendita
Resident OrderLineTable;

Concatenate (OrderTypeLimitations)
LOAD * INLINE [
TIPOORDINELIM, TipoOrdVendita
LIMITATO, S
LIMITATO, T
];

This assumes that all values of "TipoOrdVendita" exist in the "OrderLineTable".

Good luck!

HIC

[NickP_DF]

Thank you Henric for your solution!

N.