5 Replies Latest reply: Feb 3, 2017 10:07 AM by Aehman K RSS

    Section Access Question

    Sean Drummond

      Hi folks

       

      I'm trying to test a number of facets of Section Access and have found it to be a bit buggy. I'm trying to allow for all values within the reduction column (Client) to be returned. If I specify a Client value that I know is in my dataset it returns records appropriately. If I use the *, I get access is denied errors.

       

      Below is my Section access table:

      SECTION ACCESS;

      LOAD * INLINE [

          ACCESS , USERID, CLIENT

          USER, AD\USER1, *

      ];

       

      I'm using a SQL query for my report data:

      LOAD *;

      SQL SELECT ID

        , UPPER(PROCESSUSER) AS USERNAME

        , UPPER(CLIENTNAME) AS CLIENT

      FROM Table1

       

      Please note, I didn't want Section Access to match on the UserID as I only want to reduce on the Client field.

      If I add another user to my Section Access i.e.

      SECTION ACCESS;

      LOAD * INLINE [

          ACCESS , USERID, CLIENT

          USER, AD\USER1, *

          USER, AD\USER2, CLIENT1

      ];

       

      The app will give me access and will return all records for Client1.

       

      I don't understand why it would give me access when I add a second user or reduce the dataset simply because one user has this value in their reduction.

      I was of the understanding that using the * in the reduction will return all values for this value.

       

      If I do alter the report data set to use USERID instead of USERNAME i.e. allowing Section Access to authorize against the login name, keep the * in the reduction field and remove the second user, I get Access Is Denied again.

      If I put Client1 as the value in the reduction field, I can access the report with the report reduced correctly.

       

      Can someone explain Qlik's behaviour here as it doesn't appear to be consistent. I was working under the assumption that using a * in the reduction field will allow for all values in the report data set. Is this correct?

        • Re: Section Access Question
          Aehman K

          STAR is *;

           

          SECTION Access;

           

          Data:

          LOAD * INLINE [

              ACCESS , USERID, CLIENT

              USER, AD\USER1, *

          ];

           

          SQLTABLE:

          LOAD *;

          SQL SELECT ID

            , UPPER(PROCESSUSER) AS USERNAME

            , UPPER(CLIENTNAME) AS CLIENT

          FROM Table1;

           

          SECTION Application;

           

           

          Note: Here Star is * means that particular user will have access to all data, as an admin. If you want to reduce the data then

           

          Data:

          LOAD * INLINE [

              ACCESS , USERID, CLIENT

              USER, AD\USER1, Client1

              ADMIN, AD\USER2,*

          ];

           

          SQLTABLE:

          LOAD *;

          SQL SELECT ID

            , UPPER(PROCESSUSER) AS USERNAME

            , UPPER(CLIENTNAME) AS CLIENT

          FROM Table1;

           

          SECTION Application;

           

          The AD\USER2 will have admin access and AD/USER1 will be only limited to Client1 Data

            • Re: Section Access Question
              Sean Drummond

              Thanks for the response Aehman

              I tried what you suggestions and got the following behaviour

              1. I still got Access Is Denied when I tried using Star Is *

              2. When adding a second user in the Section Access, the user with * in the Entity reduction still returns only the values for the reduction value for the other user.

               

              If I get time, I'll build some inline tables with some dummy report data to test this against further, that way it might be easier for us to diagnose this behaviour.

            • Re: Section Access Question
              Sean Drummond

              I've put together the following sample data:

              STAR IS *;

               

              Section Access;

              LOAD ACCESS, USERID, LOCATION, CLIENT INLINE [

                  ACCESS , USERID, LOCATION, CLIENT

                  USER, AD\USER1, DUB, STARK

                  USER, AD\USER2 DUB, *

              ];

               

              Section Application;

              TestData:

              LOAD ID, USERID, CLIENT, LOCATION INLINE [

                  ID , USERID, CLIENT, LOCATION

                  1, AD\USER2, STARK, DUB

                  2, AD\USER2, LANNISTER, DUB

                  3, AD\USER2, TYRELL, CUR

                  4, AD\USER1, STARK, DUB

                  5, AD\USER1, GREYJOY, COR

                  6, AD\USER2, BOLTON, CUR

                  7, AD\USER1, MARTELL, COR

                  8, AD\USER1, BARATHEON, CUR

              ];

               

              Using * would appear to return only those available values in Section Access NOT the report data i.e. Stark is the only available Client value in Section Access, therefore return only this Client value where the UserID and Location also exist. This is why when I just have one record in Section Access with a * for the reduction, there are no other available values to authenticate against, hence the reason why I get Access Is Denied messages.

                • Re: Section Access Question
                  Aehman K

                  Find the attachment.

                  The Script should be

                  Star is *;

                  Section Access;

                  LOAD * INLINE [

                      ACCESS, USERID, LOCATION, CLIENT

                      ACCESS, USERID, LOCATION, CLIENT

                      USER, AD\USER1, DUB, STARK

                      USER, AD\USER2 DUB, *, *

                      ADMIN, AD\ADMIN, *, *

                  ];

                   

                   

                   

                  LOAD * INLINE [

                      ID, USERID, CLIENT, LOCATION

                      ID, USERID, CLIENT, LOCATION

                      1, AD\USER2, STARK, DUB

                      2, AD\USER2, LANNISTER, DUB

                      3, AD\USER2, TYRELL, CUR

                      4, AD\USER1, STARK, DUB

                      5, AD\USER1, GREYJOY, COR

                      6, AD\USER2, BOLTON, CUR

                      7, AD\USER1, MARTELL, COR

                      8, AD\USER1, BARATHEON, CUR

                  ];

                   

                   

                  Section Application;

                  And to test if your Section Access is working, I added

                  Test:

                  LOAD * INLINE [

                      ACCESS, USERID, LOCATION, CLIENT

                      ACCESS, USERID, LOCATION, CLIENT

                      USER, AD\USER1, DUB, STARK

                      USER, AD\USER2 DUB, *, *

                      ADMIN, AD\ADMIN, *, *

                  ];

                   

                  Here Admin will have full access and user will have reduced access as per fields you've given and by NTNAME.

                  When you use Star is *;

                  In table viewer you'll see the value as 'Total' for him (which means this user has full access).

                  Try it and let me know.

                  Thanks.