QMC Session Access Error

[radsvelosoqlikv]

Good afternoon people,

I have a problem and I would like to know if someone has already gone through this and how to solve it.

I have the Qlikview 12 SR5 version installed on my my server.

Before updating, the application worked perfectly, after the update stopped working giving file access error.

Contextualizing,

I have an application that blocks client access to some tabs, we are blocking through NTName,

The interesting thing is that if I open the same application directly in Qlikview 12 it does the access blocking of the tabs (the way it has to work), but when I try to access through the Access Point it's an error and says that I do not have access to the application.

Has anyone got this error that might help me?

Thank you all.

[Miguel_Angel_Baeyens]

There have not been changes on section access behavior I can remember. Which version did you have before 12.x? Which version do you have now 12.10 SR5 or 12.20 SR5? Did you check the release notes of the version you have?

[radsvelosoqlikv]

Hi Miguel, thanks for answer, the version old was 12.20 SR7 and the actual version is 12.20 SR5.

Yes I checked the release notes.

The problem is that when I access with admin reload the session access works well, but when I access with another account the session access doesn't  works.

When I use a similar case in the dev environment the session access works well with all the accounts.

Thanks Miguel for your help.

Sincerely

Rafael Veloso

[Miguel_Angel_Baeyens]

What do you mean by "section access doesn't work"?

• That does not allow you to open the file (no access)?
• That the reduction does not happen (all data is displayed)? Is the account which runs the QlikView services included as ADMIN in the section access table?
• Are you using "*" in the reduction field of the section access without listing ALL values IN the section access table?
• How are you opening the file, locally using QlikView Desktop or using the Ajax client?

[radsvelosoqlikv]

Hi Miguel, then.

I tried all options,

How when I open the Ajax Client I recieve a message  "You don't have access to open this aplication". But in the Qlikview Desktop, I open the document and the section access reduction the document (Works fine) .

The Admin is included in the section access table and for all values I use "*".

If I comment the section aplication for sheet, the document open normally in the Ajax client.

I use this  code.

Section Access;

Acesso:

LOAD ACCESS,

     NTNAME,

     DP_ID

FROM

(ooxml, embedded labels, table is Geral)

WHERE [APLICACAO] = 'JOBCONTROL';

Section Application;

Seguranca:

LOAD

     DP_ID,

     Area

FROM

(ooxml, embedded labels, table is [JobControl Seguranca]);

Sheet:

LOAD NTNAME,

     SH19,

     SH10,

     SH20,

     SH22,

     SH23,

     SH12

FROM

(ooxml, embedded labels, table is JobSheet);

[Miguel_Angel_Baeyens]

It works in the Desktop because your user account is listed as ADMIN, which means the user can open the application locally without restriction.

However, there are two important considerations for section access using clients: Ajax but it applies also when QlikView Desktop is using Open In Server:

1. ADMIN users have less or no "special powers". For example, in client mode, the application cannot be reloaded (the reload button is disabled) or the script cannot be edited. This applies for both Ajax and Desktop or Plugin. Worth mentioning the "Admin Override Security" in the Document Settings > Security tab.
2. The "*" symbol means "all values listed in the field in the section access table", not "all the values in the field in the data model". In a very simple example, if the section access table is only one line like

SECTION ACCESS;

LOAD * INLINE [
ACCESS, NTNAME, COUNTRY
ADMIN, DOMAIN\ACCOUNT, *
];

SECTION APPLICATION;

This account will not have any value even if the COUNTRY field has several in the data model, because in the section access table above there is no value. If in addition Strict Exclusion is checked in the document properties, the user is locked out of the application.

A better approach for such case would be

SECTION ACCESS;

LOAD DISTINCT
  'ADMIN' AS ACCESS,
  'DOMAIN\ACCOUNT' AS NTNAME,
  Country AS COUNTRY
FROM Countries.qvd (qvd); // or whatever the source where all countries are stored.

SECTION APPLICATION;

Which means that this account will have as many lines in the section access table as distinct values exist in Countries.qvd for the field "Country".

Once all those values are listed, and only then, you can use the "*", as all possible values have been already populated in that column of the section access table.

So it can happen, as it seems to be the case, that an ADMIN user is locked out using a client.

EDIT: minor edits with a proper language.

[radsvelosoqlikv]

Thanks Miguel,

I will try and send to you the answer.

[puneetagarwal]

Hi Miguel ,

We are facing the same issue.. The same section access code is working on the environment  without publisher and on the other server with publisher same code is not working.

Server with Publisher and without publisher make the difference for the coding ( for Section Access).

Thanks in advance.

Regards,

Puneet Agarwal

[Miguel_Angel_Baeyens]

Are the accounts running the services for QlikView the same in both computers and is it included in the section access as ADMIN?

[puneetagarwal]

Yes its same.