4 Replies Latest reply: Oct 19, 2015 3:53 PM by Craig Leach RSS

    Issue with Section Access

    Vladimir Komarov

      I’ve noticed an interesting “feature” in QS Section Access:

      1. I have a list of users that have restricted access to one Region each:
        1. ACCESS, USERID, REDUCTION, OMIT
        2. USER, SYSTEM\USER1, CANADA,
        3. USER, SYSTEM\USER2, CHICAGO,
        4. USER, SYSTEM\USER3, MIDWEST,
      2. I have few other users that should have a full access to all regions
        1. USER, SYSTEM\USER10,*,
        2. USER, SYSTEM\USER11,*,
      3. The problem is users from “All Regions” list (User10 and User11) can see only regions listed for “restricted” users. So both these users can access Canada, Chicago, and Midwest regions, but nothing else (I do have ~30 other regions in the data set).
      4. Creating another user (User100) with all available regions explicitly listed gave User10 and User11 access to all other regions.
      5. Did I miss anything in the Section access code? Or it’s a “feature” which will be fixed soon?

      I will appreciate any suggestions.

       

      Regards,

      Vladimir

        • Re: Issue with Section Access
          Massimo Grossi

          * in section access is for all listed values, not all values

           

          If you search in Qlik help, you can find it, this is an extract

          A wildcard, i. e. *, is interpreted as all (listed) values of this field, i.e. a value listed elsewhere in this table. If used in one of the system fields (USERID, PASSWORD, NTNAME or SERIAL) in a table loaded in the access section of the script, it is interpreted as all (also not listed) possible values of this field.

           

          This isn't a bug, it's by design

            • Re: Issue with Section Access
              Jonathan Poole

              Here is dynamic way you could add users to the section access table that are associated with all values. In my case it makes sure that user 'QTSEL\JPE' can see all countries.

               

              section access ;

               

              //load users who can see restricted rows

              Security:

              load * inline [

              ACCESS,USERID,COUNTRY

              USER,QTSEL\CANADA,CANADA

              USER,QTSEL\OTHER,FRANCE

              ]

              ;

              //load user who can see all rows

              Concatenate (Security)

              LOAD distinct

                'USER' as ACCESS,

                  'QTSEL\JPE' as USERID,

                upper([countries_world.Name]) as COUNTRY

              FROM [lib://Data/Customers.xlsx]

              (ooxml, embedded labels, table is Customers);

               

               

              section Application;

               

               

              Customers:

              LOAD [CustomerID],

                [Address],

                [City],

                [Customer],

                [ContactName],

                  [countries_world.Name],

                  upper([countries_world.Name]) as COUNTRY,

                [Fax],

                [Phone],

                [PostalCode]

              FROM [lib://Data/Customers.xlsx]

              (ooxml, embedded labels, table is Customers);

            • Re: Issue with Section Access
              Craig Leach

              Vladimir,

               

              This is just the way Section Access functions. If I want the "*" users to have access to the entire dataset. I typically create a "dummy" user in Section Access that has a row for all reduction values.

               

              Regards,

              Craig Leach

              • Re: Issue with Section Access
                Vladimir Komarov

                Thank you, 

                 

                I've found a workaround for this issue (by loading all Regions separately), but I did not realize that it was required by design.

                Will remember that now, but just wondering, why it was done this way? I am sure it would be possible to organize the link between all regions without explicitly listing all of them...

                 

                Regards,

                Vladimir