Section Access - Admin is not really Admin(?!)

[Sahal]

Hi Qlik Community.

I have a case with qlik about section access and the admin role/rights.

I would like to here you guyse toughts about this.

My section access table looks like this:

1st row is the service account for qlik

2nd row is a user that should see the application and only see the reduced data for division 023

(Now the interesting thing)

3rd row this user should be an ADMIN that should see ALL data in the source document and in the distributed application.

4th row this user should be able to see the application but not be able to access it.

The Strict Exlusion is checked (and it should be)

This should be the way section access work in my opinon and from reading alot of topics here and on google people seams to want the same.

The '*' should not have any meaning in section access (or mabye it should?) but if so then the '*' should be on ALL field values and not only on the reduced values. (USERS ='*'. ADMIN should still se Everything)

I´m i thinking this wrong or what do you guys Think?

/ Thank you.

[Sahal]

Hi Ruben, for me this works.

USER1 only sees DIVISION 023

USER2 sees all data ( i do not have a inline for my acual data i have a table in the DB that contains more the 100.000 records for the DIVISION field this was JUST an example)

[rubenmarin]

Ok, just wanted to advise, with that way you can remove the last join and it should work just the same.

[Sahal]

Hi,

I would like to bring this topic back to life.

You where right Ruben my approach did not work as expected.

You wrote this:

--------

Section Application;

LOAD * Inline [

    DIVISION, DATA

    023, 023

    011, 011

    001, 001

];

Section Access;

Security:

LOAD * INLINE [

    ACCESS, USERID, PASSWORD

    ADMIN, ADMIN, ADMIN

];

Join

LOAD FieldValue('DIVISION', IterNo()) as DIVISION

AutoGenerate 1

While IterNo()<=FieldValueCount('DIVISION');

// Using fieldvalue you get all the values, no matter wich table they are

LOAD * INLINE [

    ACCESS, USERID, PASSWORD, DIVISION

    USER, USER, USER, *

    ADMIN, ADMIN2, ADMIN2

    USER, USER2, USER2

];

--------

How do you relate the superadmin with all the values of division?

Where is the connection between ADMIN and all the data in divison?

[rubenmarin]

Hi Sahal, from what I see in the script, first loads the ADMIN and the does a join with all the values in the division field.

Doing a join without any related field (the 2nd table only has the DIVISION field, wich doesn't exists in the first table) will return a combination of all possible values, so here is where the ADMIN is related with all the divisions.

Section Access;

Security:

LOAD * INLINE [

    ACCESS, USERID, PASSWORD

    ADMIN, ADMIN, ADMIN

];

Join

LOAD FieldValue('DIVISION', IterNo()) as DIVISION

AutoGenerate 1

While IterNo()<=FieldValueCount('DIVISION');