3 Replies Latest reply: Nov 20, 2015 10:00 AM by Jonathan Poole RSS

    Section Application with NTNAME and USERID in Section Access

    Andy Lin

      I have two user directories.  One is from Active Directory and one is from SQL.  I am trying to configure my app to be accessible by both user directories.  I have tried something similar to the following:

       

      ACCESS, NTNAME, USERID, S_LINK

      USER, DOMAIN\XXX, *, SALES

      USER, *, YYY, MARKETING

       

      However, I am not sure if it's because of the wildcard, all SQL users are given access to SALES.  I am trying to set it up so that Active Directory users can only access SALES data and SQL users can only access MARKETING data.  Any suggestion on how to set up my section access and section application?

       

      Thanks.

        • Re: Section Application with NTNAME and USERID in Section Access
          Jonathan Poole

          Is this for Qlik Sense ?  the section access syntax in Sense does not support NTNAME

           

          http://help.qlik.com/sense/2.1/en-US/online/#../Subsystems/Hub/Content/Scripting/Security/sections-in-script.htm

           

          In Sense (Server only) you would use USERID field to reference the users . Not that you can still reference the group under USERID as well as individual users. So if you have groups in your AD/SQL repositories and you have synced them into sense, you should be able to use them.

           

          * will only reference the other explict values in the section table.

            • Re: Section Application with NTNAME and USERID in Section Access
              Andy Lin

              Thank you for the response Jonathan.  I understand that NTNAME isn't listed in the Sense documentation, however based on my own experiments and other user threads, it seems to work.  I have tried adding AD user under USERID column, but it doesn't work.  I kept getting Access Denied error.  Adding AD user under NTNAME opened up access to the app for AD user.  However, it screws up the data reductions.  I am looking if anyone has accomplished this before and can provide code samples.

                • Re: Section Application with NTNAME and USERID in Section Access
                  Jonathan Poole

                  Hi Andy - sorry to hear that.  I have had some finicky things with it but it does work.  In case you want to try get it working again as documented here are some ideas . I think once that is solved it should be easy to get the row filters in place as you need

                   

                  Some ideas why it may not be working as documented:

                   

                  - have you enabled the 'legacy' script mode ?  (there is a way to change qlik sense to accept legacy qlikview script instead of standard qlik sense script. They are essentially the same with minor differences , section access being one. Have you done this ? )

                   

                  - When you log in as a user what is the USERID that shows in the hub. In my screenshot below the correct reference would be  QTSEL\JPE

                   

                  Capture.PNG

                   

                  And a section access script to restrict this users to see only  COUNTRY=CANADA   (all upper case) would be:

                   

                  Capture2.PNG