Section Access with Multiple fields

[alec1982]

Hi guys,

I have a section access issue that really pissed me off!

my QVW contains of one table

and my section access is as follow:

Access     NTNAME     %MANAGER     %DIRECTOR     %DEPARTMENT

ADMIN     ADMIN                                  

ADMIN     ABC                *                          *                   SALES

ADMIN     ABC             ABC                        *                   INVENTORY

Based on the above the user ABC should see all data in sales department and he should see data from Inventory department where he is a manager.

Not sure what's wrong but the user sees all data in both Sales and Inventory departments..

Please let me know if you can help!

Best,

Alec

[alec1982]

Here is my section access script:

Section Access;

Star is *;

LOAD ACCESS,

    UPPER(NTNAME) AS NTNAME,

     %DEPARTMENT,

     %MANAGER,

     %DIRECTOR    

FROM

[..\Excel Input\Security.xlsx]

(ooxml, embedded labels, table is Users);

Section Application;

Manager:

LOAD distinct

  Upper([Manager]) as   %MANAGER

Resident Combined;

Director:

LOAD distinct

     Upper([Project Manager]) as %DIRECTOR

Resident Combined;

Department:

LOAD 

     %DEPARTMENT

FROM

[.\Security.xlsx]

(ooxml, embedded labels, table is DEP);

[hic · Accepted solution]

Sorry, but this is how QlikView works: This Section Access is evaluated according to the normal QlikView logic, which means

     (Manager=* or Manager='ABC') and (Department='Sales' or Department='Inventory')

but you would rather want it the other way around

     (Manager=* and Department='Sales') or (Manager='ABC' and Department='Inventory')

To use several reducing fields in Section Access, you need to create one single reducing key. See

http://community.qlik.com/blogs/qlikviewdesignblog/2012/10/02/complex-authorization

HIC

[alec1982]

Hi,

Thank you for your help!

I have looked at the link but still confused..

As you can see i have three fields that I am reducing data based on and I am not sure hw can i use your method to accomplish the requirements using section access.

Would you please help me.

Best,

Alec

[hic]

You should

1. Replace the stars with an ANY symbol, e.g. '<ANY>'
2. Load ACCESS, NTNAME and %AUTHID from the authorization table, where %AUTHID is the generic key: a concatenation of %MANAGER, %DIRECTOR and %DEPARTMENT
3. Find a table where all three reducing fields are well defined. It is most likely your central transaction table. In this you should create a non-generic AuthID, also as a concatenation of the three fields.
4. Create the bridge table between %AuthID and AuthID. Here you want X|Y|Sales to link to not just itself, but also to X|<ANY>|Sales,<ANY>|<ANY>|Sales, etc. So you need to use several Load statements. 

I strongly suggest you look at the Tech Brief about generic keys. http://community.qlik.com/docs/DOC-3451

I have attached a template script.

HIC

[#6]

Thanks so much - I have finally got complex authorisations in my applications.  And I've only locked myself out once (well, twice, but who's counting? )