Section access and data reduction - ADMIN user has data reduced

[#1]

Dear all,

I have a problem with section access which is driving me crazy.

I'm trying to reduce data according to Section Access script. This is my dataload script:

Section Access;
LOAD * INLINE [
    ACCESS, USERID, PASSWORD, COUNTRY
    ADMIN, ADMIN, ADMIN, *
    USER, CICCIO, CICCIO, *    
    USER, PLUTO, PLUTO, IT    
];
Section Application;
LOAD * INLINE [
     COUNTRY, ZONE
     IT, Lombardia
     IT, Piemonte
     UK, Zone1
     UK, Zone2   
];

I set document options flagging:

- Initial data reduction based on Section Access (with Strict Exclusion option)

- Admin Override Security

If I access the document as ADMIN user and perform a "Data reload", I can see all the zones (form both UK and IT countries).

The problem appears when I save, close and re-open the document (always as ADMIN):  as soon as I re-open, UK zones disappear: document is reducing data.

I did some tests and it seems that this behaviour appears when there is no user with an explicit permission for UK.

In fact, if I modify the data load script setting UK as country for CICCIO, the problem disappear and everything works as expected.

Section Access;
LOAD * INLINE [
    ACCESS, USERID, PASSWORD, COUNTRY
    ADMIN, ADMIN, ADMIN, *
    USER, CICCIO, CICCIO, UK    
    USER, PLUTO, PLUTO, IT    
];
Section Application;
LOAD * INLINE [
     COUNTRY, ZONE
     IT, Lombardia
     IT, Piemonte
     UK, Zone1
     UK, Zone2   
];

After this change, ADMIN user isa able to see all countries even if I close and re-open the document.

Do you have any idea on why Qlikview perform the reduction and how to avoid it?

Obviously I may consider to create a dummy user having expicit permissions on each country ... but please, consider that this is only an example.

Section access data reduction in my final application is based on several fields and each field has a lot of values: it may become complicated to create a dummy user in this case.

Do you have any suggestion?

Thanks in advance

Fabio Landi

[Anonymous]

Fabio,

Replace * with nothing:

Section Access;

LOAD * INLINE [
    ACCESS, USERID, PASSWORD, COUNTRY
    ADMIN, ADMIN, ADMIN,
    USER, CICCIO, CICCIO, 
    USER, PLUTO, PLUTO, IT   
];

Regards,

Michael

[#3]

Dear Michael,

thanks for your suggestion.

Your proposal seems to work properly for ADMIN (because he overrides security) but not for user CICCIO.

If I leave blank (as in your suggestion),  CICCIO cannot access the document at all.

If I use a star (*) instead, the user can access the document ... but he can see only IT (same behaviour described in my post). This is the example of script using nothing for admin and the star (*) for CICCIO.


LOAD * INLINE [
    ACCESS, USERID, PASSWORD, COUNTRY
    ADMIN, ADMIN, ADMIN,
    USER, CICCIO, CICCIO, *   
    USER, PLUTO, PLUTO, IT   
];

In addition you can test that adding a new user (JACK) with an explicit permission on UK, then CICCIO is able to see everything (as expected). Please, try this dataload script to test (nothing changes from previous example .. but I added a new user).

Section Access;
LOAD * INLINE [
    ACCESS, USERID, PASSWORD, COUNTRY
    ADMIN, ADMIN, ADMIN,
    USER, CICCIO, CICCIO, *   
    USER, PLUTO, PLUTO, IT   

    USER, JACK, JACK, UK
];
Section Application;
LOAD * INLINE [
     COUNTRY, ZONE
     IT, Lombardia
     IT, Piemonte
     UK, Zone1
     UK, Zone2  
];


Isn't it weird?

Any idea?

Regards,

Fabio

[Anonymous]

Fabio,

This is correct.
Star does not mean all - it means rather "all listed".  If the only explicitly listed is IT, the star includes only IT.  Yiu added use with UK - star includes IT and UK.  Blank includes all.

Regards,
Michael

[#5]

Michael,

Thanks, now it's clear to me.

I misunderstood the meaning of "star" and your explaination is clear to me.

My only concern is about CICCIO user.

According to your explaination using this script I expect a complete view on countries for CICCIO.

But when I try, CICCIO is no more able to access the document.

Section Access;
LOAD * INLINE [
    ACCESS, USERID, PASSWORD, COUNTRY
    ADMIN, ADMIN, ADMIN,
    USER, CICCIO, CICCIO,
    USER, PLUTO, PLUTO, IT   
];
Section Application;
LOAD * INLINE [
     COUNTRY, ZONE
     IT, Lombardia
     IT, Piemonte
     UK, Zone1
     UK, Zone2  
];

Am I doing something wrong?

In the meanwhile I'm trying to rewrite my security implementation using "Generic Keys" approach.

Thanks for all your help!

Fabio

[Anonymous · Accepted solution]

Apparently it doesn't work for ACCESS=USER.  You can either give CICCIO admin level, or repeat the line:

LOAD

* INLINE [
    ACCESS, USERID, PASSWORD, COUNTRY
    ADMIN, ADMIN, ADMIN,
    USER, CICCIO, CICCIO, IT

    USER, CICCIO, CICCIO, UK
    USER, PLUTO, PLUTO, IT   
];