Section access - Show all data to a USER

[#1]

The issue is that there seems to not be a way to limit data with section access for some users and then give all data access to other users. Here's an example:

DimensionId has values 1,2,3.

User HenryB should see all of these, while LAURAL user sees only DimesionId 1.

Section Access;

LOAD * INLINE [

    ACCESS, NTNAME, DIMENSIONID

    ADMIN, ADMIN,

    USER, HENRYB,

    USER, LAURAL, 1

];

When ADMIN opens the document, it sees everything as expected. When LAURAL opens the document, she sees DimensionId 1, as expected. But HENRYB cannot open the document at all.

For testing, I change the user HENRYB as an ADMIN:

Section Access;

LOAD * INLINE [

    ACCESS, NTNAME, DIMENSIONID

    ADMIN, ADMIN,

    ADMIN, HENRYB,

    USER, LAURAL, 1

];

Now, everything else stays the same but HENRYB is able to see all the data, as was the requirement.

Question is, how can I show all the data to the user HENRYB in this situation without making him an ADMIN? I suspect that this is not possible, but just wanted to find confirmation...

PS. If I add the asterisk for HENRYB in this way: USER, HENRYB, *, that will only show the same as the LAURAL sees, which is not the wanted scenario.

[israrkhan · Accepted solution]

Have you Tried like below:

Section Access;

LOAD * INLINE [

    ACCESS, NTNAME, DIMENSIONID

    ADMIN, ADMIN,

   USER, HENRYB,1

   USER, HENRYB,2

   USER, HENRYB,3

   USER, LAURAL, 1

];

[#3]

Oh yes, forgot to mention that and yes I know that would work. My concern there was that if the amount of dimension ids grows really high, am I in risk of suffering from severe performance issues while opening the document and during distribution?

Now that I think about it, I guess LAURAL would then also have a quite substantial list of values anyway...

Thank you anyway! If someone has any other insights to give, that would be great but I think this solved the issue in my mind well enough

[jonathandienst]

Hi

What you are seeing is the as designed behaviour. The * means "all the dimensionids explicitly listed in the section acces table" (not all possible values). So I would expect HENRYB to have the same access as LAURAL in your code.

IsrarKhan is correct. The solution is to add Henry 3 times as shown. If you have more users than shown in your example, and if you have at least 1 user for each possible DimensionID, then you can use * for HENRYB.

HTH

Jonathan

[#5]

The behavior with the ADMIN user is quite interesting though. The documentation didn't completely explain why these kind of differences happen. For example, without the strict exclusion you can have the issue that if one of your limitations does not match to any value in the field, NONE of the limitations apply! (ie. if you have section access limit values in fields Dim1 and Dim2. Then if the Dim1 doesn't contain any matches, the user is shown all the data without any limitation from Dim2 either.)

With ADMIN user, if you apply a sections access similar to LAURAL, the user sees only what is specified, but when some of the values do not match, then even with the strict exclusion enabled that user suddenly sees everything while the USER type would not be able to see the document at all.

I can provide examples of this if someone is interested. This certainly was a surprise for me when I found this out through testing...