section access - * values

[Alex]

Hi all,

The idea is to have two different User-Level Access values (ACCESS_A and FULL ACCESS). People with ACCESS_A will have access to one ore more ACCOUNTS while those with FULL ACCESS will be able to see all accounts.

As an admin, I'm trying with qlikview desktop in my local pc and it works perfectly. If I have full access, I can see all data but If I change to ACCESS_A I only see some specific accounts.
The problem comes when I publish the document to INTEGRATION where it works with ACCESS_A but for full access raises the following error: "Access denied. You're not able to open the document 19"

My config and code below:

settings > document properties > opening > initial data reduction based on section access and strict exclusion (both checked)

SECURITY:
LOAD * INLINE [
ACCCESS,NTNAME,User-Level Access,Account_Key
USER,AUTH\USER_1,ACCESS_A,ACCOUNT_A
USER,AUTH\USER_2,*,*
USER,AUTH\USER_3,ACCESS_A,ACCOUNT_B
];

Concatenate
LOAD * INLINE [
ACCCESS,NTNAME,User-Level Access,Account_Key
ADMIN,AUTH\SERVICE_ACCOUNT_INTEGRATION,*,*
ADMIN,AUTH\SERVICE_ACCOUNT_PRODUCTION,*,*
ADMIN,AUTH\ADMIN,*,*
];

//Section Access
section access;

LOAD *
RESIDENT SECURITY;

section Application;

Any idea?

Thanks for your support!

[Alex]

After the section application statement I have something like:

LOAD * INLINE [
Account_Key, Amount
ACCOUNT_A, 100
ACCOUNT_B, 100
ACCOUNT_C, 100
ACCOUNT_D, 100
];

[Alex]

I tried unchecking "strict exclusion" and it worked but I don't know what's happening exactly.


Someone who can help on that, please?

[albert_guito]

Hi, You have to use the Field Names in Seccion Access in UpperCase

[Alex]

Hi Albert,

Already tried but still not working (pic attached)

[albert_guito]

Try to remove the astherix ...

section access;

SECURITY:
LOAD * INLINE [
ACCESS,USERID,PASSWORD,ACCOUNT_KEY
ADMIN,ADMIN,admin,
USER,USER_1,1,ACCOUNT_A
USER,USER_2,2,
USER,USER_3,3,ACCOUNT_B
];

section application;
Data:
LOAD * INLINE [
ACCOUNT_KEY, Amount
ACCOUNT_A, 100
ACCOUNT_B, 100
ACCOUNT_C, 100
ACCOUNT_D, 100
];

Also, correct the ACCESS field in your code, has an additional C 🙂

Albert

[Alex]

Hi Albert,

With blank space is not filtering by any ACCOUNT so not working.

I've realized that the problem comes with the '*'. In local I can open the document because I'm admin but if I change myself to USER I'm not able to do it.

However, if I set a specific account the reduction is fine. What's happening with the '*', then? :S

[albert_guito]

Can you try if this sample is running for you?

Also I attach screenshots for every reduction applied.

You can see there how astherix (User_2)shows the list of Accounts you are using in the secction access, and empty show all (admin).

Albert

[albert_guito]

The rest of screenshots (we only upload 3 files per post 😞

[Alex]

Hi Albert,

Still doesnt' work with blank space.

If I set my user with access = "USER" instead of "ADMIN" and ACCOUNT_KEY = "*" instead of some specific accounts, I can't access to Qlikview (access denied). Find attached the security.qvd format.

Btw, USER-LEVEL ACCESS is just to hide/show some buttons in the main pane.


The section access code:

section access;

LOAD ACCESS,
NTNAME,
ACCOUNT_KEY
FROM
[..\..\Data\Delivery_Hours_Dashboard\Security.qvd]
(qvd);

section Application;

OLEDB CONNECT TO XXX;

SQL SELECT distinct R.regionalID as ACCOUNT_KEY,
R.regionalName as 'Account Name'
FROM Regional R;