Qlik Community

QlikView App Dev

Discussion Board for collaboration related to QlikView App Development.

Announcements
QLIKWORLD LIVE! MAY 16 - 19TH, EARLY BIRD DISCOUNTS! REGISTER TODAY
cancel
Showing results for 
Search instead for 
Did you mean: 
NickP_DF
Creator
Creator

Reduction field in section access

Hi guys,

I'd like that a user shouldn't be able to see the S or T order types (the other users must see everything), so that I create a section access like that:

Section Access;
LOAD * INLINE [
ACCESS, USERID, PASSWORD, ID, ACCESSORDERTYPE
ADMIN, ADMIN, xxx, 0,
ADMIN, BOB, yyy, 1,
ADMIN, JOHN, aaa, 1
USER, MIKE, hhh, 2, S
USER, PAUL, zzz, 2,
USER, LAURA, ttt, 2
];

Section Application;

AccessGroups:

LOAD * INLINE [

ID, GROUP
0, ADMINISTRATORS
1, PRODUCTION
2, FABRIC
];

In this way, it works properly for the users ADMIN, BOB, JOHN (who see everything), the user MIKE sees only "S" order type and the users PAUL and LAURA get the error "The document...failed to load" 🙄

Besides that, If I add a line to above the MIKE user to avoid him to see the S and the T order types:

...

USER, MIKE, hhh, 2, S
USER, MIKE, hhh, 2, T

...

 

it works properly for the users ADMIN, BOB, JOHN (who see everything, like in the previous version), and the users MIKE, PAUL and LAURA get the error "The document...failed to load."

What's wrong with my script?

Thank you so much.

N.

1 Solution

Accepted Solutions
Henric_Cronström

Yes, it is possible. One way to do it is along the following lines:

Section Access;
LOAD * INLINE [
ACCESS, USERID, PASSWORD, ID, TIPOORDINELIM
ADMIN, ADMIN, xxx, 0, <ALL>
ADMIN, BOB, yyy, 1, <ALL>
ADMIN, JOHN, aaa, 1, <ALL>
USER, MIKE, hhh, 2, LIMITATO
USER, LAURA, ttt, 2, <ALL>
];

Section Application;
OrderTypeLimitations:
Load distinct
'<ALL>' as TIPOORDINELIM,
TipoOrdVendita
Resident OrderLineTable;

Concatenate (OrderTypeLimitations)
LOAD * INLINE [
TIPOORDINELIM, TipoOrdVendita
LIMITATO, S
LIMITATO, T
];

 

This assumes that all values of "TipoOrdVendita" exist in the "OrderLineTable".

Good luck!

HIC

 

View solution in original post

5 Replies
Or
Master II
Master II

For starters, your script doesn't actually give PAUL and LAURA any permissions because you left ACCESSORDERTYPE null. You should be using * for "Everything" (excluding nulls, but you should generally avoid the use of section access on fields with nulls), which may also require a * is star statement.

Since you are using multiple fields for your section access, it'd be best to start with this:

https://community.qlik.com/t5/Qlik-Design-Blog/Basics-for-complex-authorization/ba-p/1465872

 

NickP_DF
Creator
Creator
Author

Hi,

thank you for your answer 🙂

I've read your reply and the documentation you suggested and I've changed my script as: 

Section Access;
LOAD * INLINE [
ACCESS, USERID, PASSWORD, ID, ACCESSORDERTYPE
ADMIN, ADMIN, xxx, 0,
ADMIN, BOB, yyy, 1,
ADMIN, JOHN, aaa, 1,
USER, MIKE, hhh, 2, S
USER, MIKE, hhh, 2, T

USER, LAURA, ttt, 2, *
];

 

Section Application;

AccessGroups:

LOAD * INLINE [

ID, GROUP
0, ADMINISTRATORS
1, PRODUCTION
2, FABRIC
];

 

The results are:
- the ADMIN users account log in and see all the order types, as I wish
- MIKE user logs in, but he can see only the 'S' order types (not also the 'T' as I wish)
- LAURA user logs in, but he can see only the 'S' order types (not ALL the order types as I wish)  

Pls. note that LAURA behavior is what I expected since I've read in the documentation that the "*" grants all the reduction listed in section access, but I'd like her to be allowed to all the order types (from 'A' to 'Z')

Thanks.

N.

NickP_DF
Creator
Creator
Author

....So I've made a step ahead and now I'm able to allow multiple values to MIKE

Section Access;
LOAD * INLINE [
ACCESS, USERID, PASSWORD, ID, TIPOORDINELIM
ADMIN, ADMIN, xxx, 0,
ADMIN, BOB, yyy, 1,
ADMIN, JOHN, aaa, 1
USER, MIKE, hhh, 2, LIMITATO
USER, LAURA, ttt, 2, ALL
];


Section Application;

AccessGroups:

LOAD * INLINE [

ID, GRUPPO
0, ADMINISTRATORS
1, PRODUCTION
2, FABRIC
];


OrderTypeLimitations:

LOAD * INLINE [

TIPOORDINELIM, TipoOrdVendita
LIMITATO, S
LIMITATO, T
];

 

The results are:
- the ADMIN users account log in and see all the order types, as I wish
- MIKE user logs in, and he can see only the 'S' and the 'T' order types, as I wish

I'm not able to allow LAURA to see ALL the order types as I wish: I wouldn't like to list in the OrderTypeLimitations table all the rows:
ALL, A
ALL, B
ALL, C

...

ALL, Z

because if they'll implement a new Order Type in the future (such as '$', for example), LAURA won't be able to see it without my intervention in the section access code).

Thank for the help.

N.

Henric_Cronström

Yes, it is possible. One way to do it is along the following lines:

Section Access;
LOAD * INLINE [
ACCESS, USERID, PASSWORD, ID, TIPOORDINELIM
ADMIN, ADMIN, xxx, 0, <ALL>
ADMIN, BOB, yyy, 1, <ALL>
ADMIN, JOHN, aaa, 1, <ALL>
USER, MIKE, hhh, 2, LIMITATO
USER, LAURA, ttt, 2, <ALL>
];

Section Application;
OrderTypeLimitations:
Load distinct
'<ALL>' as TIPOORDINELIM,
TipoOrdVendita
Resident OrderLineTable;

Concatenate (OrderTypeLimitations)
LOAD * INLINE [
TIPOORDINELIM, TipoOrdVendita
LIMITATO, S
LIMITATO, T
];

 

This assumes that all values of "TipoOrdVendita" exist in the "OrderLineTable".

Good luck!

HIC

 

NickP_DF
Creator
Creator
Author

Thank you Henric for your solution!

N.