Can't get Section Access or Reduction working w/ QMC

[Anonymous]

I've been trying to get this working for a week, and am having a heck of a time with it. I've read through the docs, some posts, and watched a bunch of the videos on Section Access and Reduction, and think I understand the concepts, but I can't get it to work the way I expect.

The App (AP.QVW) is a simple Invoice Tracking app. I want to be able to provide all the data to the Finance users, while also providing a particular department's data to certain people in that department. I'm initially trying to get Section Access working, which I believe would create a single QVW in AccessPoint that would be reduced depending on the user that is opening the QWV (correct?). Once this is working, I may want to experiment with creating separate files for each Dept. (AP - Technology, AP - HR, etc...), making only the files a user would have access to visible to them in AccessPoint.

To accomplish this, I set up a Section Access Table in QMC:

Access | NTNAME | Department

ADMIN | DOMAIN/LEE | *

ADMIN | DOMAIN/SVCIOTQLIKVIEW | *

USER | DOMAIN/PAUL | TECHNOLOGY

USER | DUMMY | DISTRIBUTION

USER | DUMMY | TECHNOLOGY

etc...

I have the following in my hidden script:

Section Access;

UserAccess:

LOAD ACCESS,

     NTNAME,

     DEPARTMENT.DEPARTMENT_NAME_SA

FROM

[http://<QlikSrvr>:4780/QMS/AuthTable]

(html, utf8, embedded labels, table is [BillPay]);

Section Application;

ApplicationAccess:

LOAD NTNAME,

     DEPARTMENT.DEPARTMENT_NAME_SA

FROM

[http://<QlikSrvr>:4780/QMS/AuthTable]

(html, utf8, embedded labels, table is [BillPay]);

In my Department Table, I have DEPARTMENT_NAME and DEPARTMENT_NAME_SA, which is just UPPER(DEPARTMENT_NAME). As it stands now, if I look at my Table Viewer, I see an 'ApplicationAccess' table linked to my Department table on DEPARTMENT_NAME_SA.

On the 'Opening' tab of the QVW's Document Properties, I have 'Initial Data Reduction...' and 'Strict Exclusion' selected.

I then put my QVW up on the server and create a Task for it. I reload, but don't do anything other than set a Category on the Doc Info tab and distribute to 'All Authenticated Users', then run the Task.

(BTW, I'm a little confused as to what the Section Access and Reduce options in QMC do, as it seems like I should be controlling SA/Reduce options from the Application scripts(?))

At this point, 'PAUL' can open the file and is limited to just seeing the Technology Department info. Seems OK.

'LEE' (me) can't open the file. I think this is because I'm not in the table as a USER. OK, fine.

I add USER | LEE | DISTRIBUTION to my Section Access Management table in QMC and re-run the Task associated w/ my file. I can now open the file as 'LEE' and see only the DISTRIBUTION department. OK, fine.

Now, for LEE in my Section Access Table, I change DISTRIBUTION to * and re-run the Task, Now I can't open the file from AccessPoint again. I change '*' to '' (blank, no actual quotes) and re-run the task. I can now open the file, but NO department information is visible. At this point, I was expecting to see all Departments, or at least the 2 that were associated with the DUMMY accounts in the Section Access table.

So, I'm not sure what I'm doing wrong at this time. Do I really need to add a row to the Section Access table for each user / department combination that I want to 'enable'? Can I have one row in Section Access per Dept with all the users that have access to it (or one row / user with all the Departments they can access)?

Any clarification anyone can provide would be appreciated. TIA!

-Lee

[Peter_Cammaert]

These are a lot of questions. I don't know where to start...

If you want to figure out why SA is doing what it is doing, it's always a good thing to start with putting the Section Access; statement in comments at first. Then reload and check in QV Desktop whether the associations do work as expected.

Remember that an asterisk in a row in the SA table may mean one of two things

• the asterisk as an ASCII character. That will not link to anything in Section Application and with strict exclusion enabled, you will be thrown out immediately. You may want to add a STAR IS ...; statement before you LOAD your SA table from the QMC. See QV Desktop help for more info.
• the asterisk as a wildcard. In that case it may work as expected with this limitation: the wildcard means "all values in the same column in this single table", not "all values in the same field in the entire data model"

Also note that role=ADMIN doesn't exist in the AccessPoint. So don't expect anything special; ADMINs will be treated the same as ordinary USERs.

One row per combination: yes, as the SA table is not different from any other regular QlikView internal table. That's at the same time an annoying limitation (everybody wants wildcards or AI in this table) and an incredible freedom.

If you can check a few things based on this information and return with fewer anomalies, we will be able to focus on solving your Section Access issue without misunderstandings, I hope.

[Anonymous]

Thanks for the quick reply.

I don't think I had that many questions, just trying to document what I've done so far.

With a single User Document, it appears as if I'm getting almost the desired results at this point, provided I create a unique row in my Section Access table for each User / Dept combination that I want to grant. The one caveat is that all users can see the document in AccessPoint, even if they have no rights to open it. I'm assuming this is a by-product of assigning 'All Authenticated Users' access on the Distribute / Manually tab.

Now, to experiment with an alternative method of distributing the document, I created a separate Task by copying the first. I made the following changes:

- On the Reduce tab, I Reduce by field value, use %SourceDocumentName% (%DocumentField,DEPARTMENT.DEPARTMENT_NAME_SA%) as my document name, and select the DEPARTMENT.DEPARTMENT_NAME_SA field in the 'Loop and Reduce Section'.

- On the Distribute tab, I remove the manual entries and, on the 'Loop Field In Document' tab, link the NTNAME to SAM Account Name in the 'Loop and Distribute' section, and select AccessPoint in the Target section.

This had the result of creating 3 Documents in AccessPoint - AP (TECHNOLOGY), AP (DISTRIBUTION), and AP (_). The first 2 correspond to Departments that had users explicitly assigned in the Section Access Management table. I suppose this is OK. Not sure where the 3rd with the '_' came from. The users that are defined to the Departments in the Section Access Management table see only the documents they have access to, plus the '_' doc, though no user seems to be able to open the file w/ the '_'.

I went back and created a DUMMY user assigned to each Dept, just to see if it would at least create the additional files, but it didn't. However, if I assign real User IDs to a Dept,, it then creates the document for that Dept. It's still creating the '_', though. I think it has something to do w/ the Admin users and having the '*' in the Dept field for them.

So, is this basically how QV and the server tasks are supposed to behave? If so, I'll chew on this for a bit, but may come back with a few more questions.

Thanks again for any insights!