In-app reporting and Section Access - recipients treated as external

[Rujena]

I am having an issue with in-application reporting where my (supposedly) internal recipients of a html email report receive the full data scope of the app, instead of the reduction done by Section Access.

My guess is that Qlik does not recognize them as internal recipients, because our Section Access uses USERID (OKTA\email), instead of USER.EMAIL This is a serious security issue and I am looking for a way to 1. reduce the data shown to external recipients or block it completely and 2. find a way to restore Section Access for recipients of reports. 

Any ideas?

[JacovCohenQ]

Hi, have you tried with a conversion table from USERID (OKTA\email) to USER.EMAIL, and then set the Section Access?

[Rujena]

Yes, unfortunately it still doesn't work. Even with 1:1 match, upper case/lower case, etc. Still each recipient receives their own data + the data for the other recipients, as if all recipients are treated as externals.

I wonder if it has anything to do with the IdP sub settings (it is not set to email and we cannot change them as that would have implications outside the current project and we do not want that)

[Chanty4u]

Hi

If possible, use the identity that Qlik Cloud recognizes (for example, USER.EMAIL or the authenticated user ID) instead of OKTA\email.

Ensure the value in USERID exactly matches the authenticated identity

,..........can you tell me 

Does your identity provider (Okta) authenticate users with OKTA\email or just email@company.com?

What value does Qlik return for the logged-in user (for example, using functions such as OSUser() or the Cloud user email)?

Do the values in your Section Access USERID field exactly match the authenticated identity

[Andrew_Kruger]

Hello @Rujena  - I think the clarity you are looking for is here under the heading Differences between internal and external recipients - https://help.qlik.com/en-US/cloud-services/Subsystems/Hub/Content/Sense_Hub/Reporting/Generate/cloud....