I think I found the reason for the issue I was experiencing. My QS version is 2.03, and this is from the 2.04 release notes (bug fixes):
Section Access - Access Denied using GROUP attribute for USERID with special characters Jira issue ID: QLIK-39389, QLIK-40021 If special characters, such as @, are used in a USERID of a user included in a GROUP, the user is denied access.
thanks for your answers but I got it now working. I hadn't realized that I have to add also the user directory information in to the beginning of the USERID when I create the custom USERID from my database table user_id e.g.:
'USERDIRECTORY_XYZ\' & Upper(user_id) as USERID, ...
and then include the same user directory to the JSON calling the ticket, e.g.:
And now when my web app receives the ticket and when I open a view in my web app where I've embedded Qlik-sheet to iframe, it works ok and the user that has logged in to my web app can only access his/her data!