Active Directory Limiting Data Access

[#1]

Hi guys,

I just had a look at the latest blogroll post on using AD to limit access to QlikView. Very interesting stuff. One thing that wasn't mentioned, and that I am curious about, is how to use AD to limit access not to an entire QV file, but to certain parts of the data set.

The immediate example is limiting the leader of a regional office to access only his own region's data.

Is this doable? And can it be done automatically, so that an organization with several hundreds of regions could implement it?

Thanks,

Even

[amars]

Hi,

As you know you can achieve it by using Section Access. How the Section access work's is it uses a set of selection's based on which the data is being reduced. For that we can use Document Properties -> Opening -> Initial Data reduction based on section access tag. Make it on & the application will reduce the data based on ur login credential's.

In your case u can use it in this format.

Section Access;

Load * INLINE[

ACCESS, NTNAME, Region

Admin, NTUser1, Region1

User, NTUser2, Region2

Admin, PowerNTUser, *]

Where * represents the user for which all the regions need to be shown. * represent's all. The Field Region should be present in ur data so it will create a join based on the field Name. So whenever user NTName1 tries to access the report the section access data get's reduced to only one row of the first user & because a join is there between the REgion of Section Access & ur Data . The data for Region1 will only be shown to the user.

Hope this helps.

[#3]

Hi Amars,

Thanks for the quick and thorough reply! Such an active community is another feature of QV that truly separates it from the competition.

Best regards, Even

[#4]

Hi all,

Got a similar problem :

In a very simple test document with a list box which show differents "délégation abr" (CENTRE,EST_NORD,EST_SUD...). I want to limit the access to only one délégation abr (CENTRE) for my USER2 and use the active directory connexion.

I have the following hidden script :

Section Access;
LOAD * INLINE [
ACCESS, NTNAME, "Délégation abr"
ADMIN, DOMAIN\user1, *
User, DOMAIN\user2, "CENTRE"
];
Section Application;

The authentification is working. Only these 2 users can open the doc. but both of the user see all the "délégation abr" in the document.

What i have to do for showing only the delegation "CENTRE" when User2 open this document or just allow to select this Délégation in the list box ??

Thanks for your help !

[#5]

I found it, here is my solution :

Section Access;
LOAD * INLINE [
ACCESS, NTNAME, DELEG
ADMIN, domain\user1, ALL
USER, domain\user2, CENTRE
USER, domain\user3, EST_NORD
];

Section Application;
STAR IS toutes;

security:
LOAD * inline [
DELEG, "Délégation abr"
ALL, toutes
CENTRE , CENTRE
EST_NORD , EST_NORD
];