Unlock a world of possibilities! Login now and discover the exclusive benefits awaiting you.
Hi All,
I have this scenario where i am using the same section access table out side of the section so that i can hide the sheets.
I am able to reload and see all the values in my desktop but when i move the qvw file i get the failed to open document even though i am in the admin group.
my section accss table looks like
in my Flag field which is DATA_REDUCE i have ADMIN, HR, SALES
Start is *;
Section Access;
Security:
LOAD
upper(NTNAME) as NTNAME,
upper(NTNAME) as SA_USER,
upper(USER) as USER,
If(upper(Flag)='ADMIN','*',upper(Flag)) as DATA_REDUCE;
SQL SELECT *
FROM SA_Table;
Section Application;
GrpLevel:
LOAD
Upper(NTNAME) AS SA_USER,
Upper(GROUPNAME) AS GROUPNAME,
Upper(Sheet1Access) AS Sheet1Access,
Upper(Sheet2Access) AS Sheet2Access,
Upper(Sheet3Access) AS Sheet3Access;
SQL SELECT * SA_Table;
I have HR, SALES, ADMIN in the section table while HR, SALES,NA in the data model table - when i reload and publih this qvw file to the server and go to the access point i cannot open the docuemnt even though i am the admin
- can someone please suggest - i think it is better to use the "strict exclusion" but if i check that i am getting error
Take a look at this list of examples of creating SA:
https://community.qlik.com/t5/QlikView-Documents/QlikView-Section-Access-Examples/ta-p/1492719
Example 4 might be the one you are looking for.
Hi Arthur/Hi All,
Based on the example 4 from Collin - It looks like i need to insert the DUMMY records - how many DUMMY records?
Find out the distinct values in the DATA_REDUCE field in the table in data model (not section access table) then insert those many DUMMY records - right? in my case i have 3 distinct values NA, HR, SALES in the DATA_REDUCE field in my data model table - so i need to insert 3 DUMMY Records - is this right?
still getting the same issue.. i have the same values in both the table in data model and the section access table
but still i get the failed to open document message on the server
If you look at the section access example by Colin, the table consists of these fields:
Access, UserID, Password, CostCentre
where
Access, UserID, and Password are the key fields that should not be renamed.
Maybe try renaming your SA table columns with the respective key fields.
Hey Arthur, i use NTNAME so it was working fine. When i added this new logic strict exclusion is not working
Have a look at the following Design Blog post, there are some related posts at the bottom on this one too:
https://community.qlik.com/t5/Qlik-Design-Blog/A-Primer-on-Section-Access/ba-p/1465766
In regard to your comment about being an ADMIN, please note that ADMIN level only comes into play when opening via the Desktop Client, when you open via the QVServer, you are ALWAYS a USER, there are no ADMINs when running things server-side...
The strict exclusion basically means if the section access record for your user results in a non-match in a reduction field etc., will lock you out of the application. This is why when the Qlik Service Account is set to 'blank' values in the reduction fields, you cannot use the service account to open the application via the AccessPoint, as 'blank' has no matches, therefore strict exclusion will result in the app not opening. Hopefully this makes a little sense.
Here is the base URL to the Design Blog area as well in case you want to search further, and I am including the Section Access Help link below that too to cover all the bases here.
https://community.qlik.com/t5/Qlik-Design-Blog/bg-p/qlik-design-blog
https://help.qlik.com/en-US/qlikview/April2019/Subsystems/Client/Content/QV_QlikView/Security.htm
Regards,
Brett