And I set the "Initial datareduction based on section access" option in the document settings.
Now when I open the document as Administrator on the server, I only get the row with the DEPT1, VAL1 values. Just as I expected.
Opening the document with the IE plugin as domain user hkl, IE prompts me for a User ID and Password. I tried domain\username format instead of just username, and I tried lowercase, uppercase and the case QV returns with iouser(). None of this helps.
It seems to me QV does not try to authenticate me (FMD\hkl) against the domainserver at all, but that's strange as we use LDAP for authenticating all the time in QV...