Section Access - Admin is not really Admin(?!)

[Sahal]

Hi Qlik Community.

I have a case with qlik about section access and the admin role/rights.

I would like to here you guyse toughts about this.

My section access table looks like this:

1st row is the service account for qlik

2nd row is a user that should see the application and only see the reduced data for division 023

(Now the interesting thing)

3rd row this user should be an ADMIN that should see ALL data in the source document and in the distributed application.

4th row this user should be able to see the application but not be able to access it.

The Strict Exlusion is checked (and it should be)

This should be the way section access work in my opinon and from reading alot of topics here and on google people seams to want the same.

The '*' should not have any meaning in section access (or mabye it should?) but if so then the '*' should be on ALL field values and not only on the reduced values. (USERS ='*'. ADMIN should still se Everything)

I´m i thinking this wrong or what do you guys Think?

/ Thank you.

[Gysbert_Wassenaar]

Are you working with the document in the ajax client, i.e. opening it from the access point? If so, then you will always get USER level access. ADMIN level access is not available when opening documents through Qlikview Server.

[Sahal]

Hi,

Yes we are using ajax client on access point.

I do understand that the access level on access point vs document level is different but my point is why?.

This makes no seense for section access because how would i go about to give an admin access to all the data without entering all the field values in the reduced field?.

let´s say that the reduced field have 100.000 records should i then make 100.000 rows off data in my reduced field in the section access table? that to me is wrong.

Admin rights should be on both ap and document level and you should be able to leave the reduced field blankor null to be able to see everything.

[simondachstr]

You can use an asterix * to give ADMIN access to all reduced data.

[rubenmarin]

Hi Sahal, it's a bit tricky but for examples with so many values I prefer to create the section access at the end of script, when I have all values loaded, then I create the admin with all the values and all fields and so when I crete the rest of users * will really get all the values in the field:

Section Application;

LOAD * Inline [

    DIVISION, DATA

    023, 023

    011, 011

    001, 001

];

Section Access;

Security:

LOAD * INLINE [

    ACCESS, USERID, PASSWORD

    ADMIN, ADMIN, ADMIN

];

Join

LOAD FieldValue('DIVISION', IterNo()) as DIVISION

AutoGenerate 1

While IterNo()<=FieldValueCount('DIVISION');

// Using fieldvalue you get all the values, no matter wich table they are

LOAD * INLINE [

    ACCESS, USERID, PASSWORD, DIVISION

    USER, USER, USER, *

    ADMIN, ADMIN2, ADMIN2

    USER, USER2, USER2

];

Just take care that section access only allows 1 million different values, if you have more you have to do a bit more work putting them on section application and creating another field to link that table with the security.

[Sahal]

Hi, yes i know that but i want the ADMIN to have access to ALL the field values not only the reduced data.

[Sahal]

Hi,

i don´t know if im understading this correct .

What im after is to give ADMIN and USER different access rights depeding on what i specify in the ACCESS field.

i have no problem putting '*' on every new reduced field in the section access table.

in your exampel do i have to use the section access 2 times? im using an external table not an inline.

[rubenmarin]

Hi, to explain what I'm doing:

//At the end of script I set the section access (only one time, at the end)

Section Access;

//First I load the superadmin

Security:

LOAD * INLINE [

    ACCESS, USERID, PASSWORD

    ADMIN, ADMIN, ADMIN

];

// And I relate that superadmin with all the values of the DIVISION fields

Join

LOAD FieldValue('DIVISION', IterNo()) as DIVISION

AutoGenerate 1

While IterNo()<=FieldValueCount('DIVISION');

// Using fieldvalue you get all the values, no matter wich table they are

// Then I can use *, as * will be related to all values loaded in section access and we have an user with all the values,

// * will be related to all values in the field (I give it to USER just as an example, usually is given to other admins or users

// without restrictions in that field)

LOAD * INLINE [

    ACCESS, USERID, PASSWORD, DIVISION

    USER, USER, USER, *

    ADMIN, ADMIN2, ADMIN2

    USER, USER2, USER2

];

// I used a inline table but usually this is loaded from db or document (xls, csv...)

[Sahal · Accepted solution]

Hi.

Thank you Ruben this works as expected

In my opinion this solution should go in the manual for section access *How to extract data for all field values*

This is how i did it.

[rubenmarin]

Hi Sahal, that's different from what I did and won't work the way I said.

If you make the join at the end with all users, and with the DIVISION field Loaded it won't do anything.

It can work because you hard-coded all the DIVISION values meanwhile my approach load all the values loaded in the model, avoiding the maintenance of hard-coding the values.