Qlik Community

QlikView Security & Governance

Discussion Board for collaboration on QlikView Security and Governance.

Announcements
Talk to Experts Tuesday, Live Q&A, September 22: Moving from QlikView to Qlik Sense. REGISTER
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Contributor
Contributor

Section Access Suddenly Stops Working In PROD

Hello Qlik community:

I have a dashboard that has been in production for several months now.  For security, it implements "complex authorization" as outlined here - https://community.qlik.com/t5/Qlik-Design-Blog/Basics-for-complex-authorization/ba-p/1465872.  On January 3, users started reporting that they couldn't access the dashboard anymore and were getting this error message - "Failed to open document, You don't have access to this document."  No changes to any QVWs had been made at that point.   Users can have have cost center-only access, affiliate-only access, or full access.  The common denominator for users having access issues is anyone with  cost center-only access or affiliate-only access.

Edited sample from our security .xls file:

ACCESSNTNAMEEMPLOYEE_NAMECOSTCENTERAFFILIATE_NBR
USERZBC\NTNAME1NAME17551<ANY>
USERZBC\NTNAME2NAME2<ANY>VBC
USERZBC\NTNAME3NAME3<ANY><ANY>

 

However, in our TEST environment everything works fine.  All things being equal, what are the first things we should be looking at to determine why Section Access is working in TEST, but no longer in PROD?  Thank you.

Labels (2)
4 Replies
Highlighted
MVP & Luminary
MVP & Luminary

I think I would load the section access table a second time - within the section application area any by qualifying all fields unless your key-field to the datamodel. With this extra table you could check if it really contained your expected data and also if the key is further properly linking to the datamodel - you may do it within some objects in a hidden sheet or alternatively you make it in a copy of the application.

Also adding a textbox with: = osuser() is useful to see if the user is correctly identified.

- Marcus

Highlighted
Digital Support
Digital Support

Art, did Marcus post help you get things sorted out?  If so, do not forget to circle back to the thread to use the Accept as Solution button on his post to give him credit for the assistance and let other Members know this put you on the right track.  Marcus goes one step further than I normally recommend, I just have folks comment out the Section Access line loading the table as a normal table into the data model, this way you can see everything and use listboxes to check what happens when you make selections on the user in the section access table etc. to check your work.  My hunch would be something changed in your reduction fields such that you ended up with a null value, which if the Strict Exclusion option is set in the Document Properties Open tab settings, it should be by the way to be secure, then that would do what you have described.  You have to be sure the user ends up with an actual value in all reduction fields you are using, as if null hits any of them, that will likely lock them out of the app.  

Cheers,
Brett

To help users find verified answers, please do not forget to use the "Accept as Solution" button on any post(s) that helped you resolve your problem or question.
I now work a compressed schedule, Tuesday, Wednesday and Thursday, so those will be the days I will reply to any follow-up posts.
Highlighted
Specialist
Specialist

I had the same issue .. my dashboard has been working fine in PRD.  No changes made the users started to have access issue.  The same dashboard working in UAT env.  moving it to PRD users had access issue.  I am not sure if there are any settings on the server side 

Highlighted
Digital Support
Digital Support

I probably should have included these on the other post, here is a Design Blog link to a post on Section Access and there are some further related posts on Section Access at the bottom of the post as well related to Dynamic Data Reduction...

https://community.qlik.com/t5/Qlik-Design-Blog/A-Primer-on-Section-Access/ba-p/1465766

Here is the most current Help on Section Access too, please be sure you have review the documentation and ensured if there is a problem it runs against what is documented...

https://help.qlik.com/en-US/qlikview/April2019/Subsystems/Client/Content/QV_QlikView/Security.htm

The most important thing to understand when moving things to Server is ALL users become USER level access, ADMIN access is only applicable if you are using the Desktop Client and doing a File\Open option, anytime an application/QVW is opened via the Server, you are always doing so as a USER access level, so the Admin Override is no longer in effect...

Regards,
Brett

To help users find verified answers, please do not forget to use the "Accept as Solution" button on any post(s) that helped you resolve your problem or question.
I now work a compressed schedule, Tuesday, Wednesday and Thursday, so those will be the days I will reply to any follow-up posts.