Issue with section access

[Eliina]

Hello,

I would like to ask your help on section access issue we have with one of our QV applications.

Simplified script version is following:

AccessTemp:
load
upper(NTNAME) as NTNAME,
Upper(SECTION_ACCESS) as SECTION_ACCESS,
REGION,
COUNTRY
FROM C:\QlikView\Access.xls
(biff, embedded labels, table is Main$);

Access:
load
NTNAME,
SECTION_ACCESS,
REGION &'|'& COUNTRY as %AuthID
resident AccessTemp;

drop table AccessTemp;

Section Access;
LOAD upper(ACCESS) as ACCESS,
     upper(NTNAME) as NTNAME,
     upper(SECTION_ACCESS) as SECTION_ACCESS
     FROM C:\QlikView\Access.xls
       (biff, embedded labels, table is Main$);
      
Section Application;

Data:
LOAD
ID,
REGION,
COUNTRY,
REGION &'|'& COUNTRY as AuthID,
SnapshotDate
FROM C:\QlikView\Data.qvd (qvd);

Bridge:
Load REGION &'|'& COUNTRY as AuthID, '<ANY>' &'|'& '<ANY>' as %AuthID resident  Data;
Load REGION &'|'& COUNTRY as AuthID, REGION &'|'& '<ANY>' as %AuthID resident   Data;
Load REGION &'|'& COUNTRY as AuthID, '<ANY>' &'|'& COUNTRY as %AuthID resident  Data;
Load REGION &'|'& COUNTRY as AuthID, REGION &'|'& COUNTRY as %AuthID resident   Data;

In Document Settings “Initial Data Reduction Based on Section Access” is set up.

Authorization key is actually consists of 6 fields, therefore there are more access combinations, but I have simplified it to show the idea.

This set up was working fine and users were able to see data as per data reduction however it is no longer working properly. Access is still reduced appropriately, but not all data is showed.

For example if we have following data in “Data” table, users see only “Current” value in SnapshotDate and appropriate access segregation. So they do not see all data that they should be seeing.

ID	REGION	COUNTRY	SnapshotDate
1	EUROPE	SWEDEN	31/12/2020
2	EUROPE	NORWAY	31/12/2020
1	EUROPE	SWEDEN	31/01/2021
2	EUROPE	NORWAY	31/01/2021
1	EUROPE	SWEDEN	Current
2	EUROPE	NORWAY	Current

I have tried commenting out section access part in script and removing setting from Document Settings and reload data on server, then all data is visible. And if I do selections in Access table based on user ID (SECTION_ACCESS) then I see all data correctly – correct access reduction and SnapshotDate field values.

So it seems that data is linked correctly.

When I set up section access back and reload data on server again not all data is visible.

It is not clear what has caused this issue, because there has been no changes in application script and this set up has worked before.

Could you please share from your experience what could be the problem?

Thank you in advance!

[rubenmarin]

Hi @Eliina, it's weird that they only see 'Current' wheren there is another row with the same ID, REGION and COUNTRY, maybe this is just because of the simplification of the issue.

First I would change %AuthID to %AUTHID, caps can broke, I'm not sure but I think in some cases I've also uppercased all values of the fields involved in section access.

Second I would move the section access to section application, then you can select an NTNAME and confirm that the filtered values are the ones you are expecting to.

And third: Note that there is a limit of a million different values on section access, if you pass this limit you can try a workaround like:

section access;
LOAD NTNAME, USER...

section application;
Table:
LOAD USER, FilterFields...

So NTNAME filters the USER and from there it applies security.

[Eliina]

Hello @rubenmarin ,

Thank you for your response, I have tried your suggestions, but unfortunately it didn’t work – had same result as previously.

However I did try a couple other scenarios.

•  I reduced access reduction to 2 parameters only. %AUTHID consist of 2 fields instead of 6 in order to eliminate any errors in script regarding access combinations. When I open application in QV Desktop I see correct access reduction and all data under “Snapshot” field.
  When I open application in Access Point I see only “Current” value in “SnapshotDate” field and correct access reduction.
• Added system user ID in SECTION_ACCESS field. Previously it had * value.

System user access set up looks following:

ACCESS      NTNAME                             SECTION_ACCESS            REGION              COUNTRY

ADMIN        DOMAIN\A12345             A12345                                   ANY                       ANY

Now when I open application in Access Point I see all data and it looks like I am opening application with system user and not my user (NTNAME). When I create table to look at Access table content it contains system user.

OSuser () returns my NTNAME and QVuser () doesn’t return anything.

If I open application in QV Desktop I see data reduced as per my user access rights and I see all “SnapshotDate” field values.

OSuser () returns my NTNAME however QVuser () doesn’t return any value.

I also tried leaving SECTION_ACCESS field blank for system user as well as leaving blank REGION and COUNTRY fields. Unfortunately same result.

My access set up is following:

ACCESS        NTNAME                             SECTION_ACCESS            REGION              COUNTRY

USER             DOMAIN\U12345                U12345                               EUROPE             NORWAY

Why in Access Point application is being opened with system user access segregation and not users NTNAME access segregation (my user), but in Desktop it works properly?

Another question is why QVuser() doesn’t return any value?

In all cases described above and in my original post, user who creates/makes amendments to application in QV Desktop has USER access level and is different from user who reloads application on server. Currently I am opening and doing changes to application with my user, but my user is not reloading application on server.

Another thing is that application has default values set in that in Document Properties -  Trigger - OnOpen for  “Snapshot” field and couple of other fields.

In Desktop it is possible to see all values in these fields, however in Access Point some of the fields show only the default value which was set up on document opening.

I have removed Triggers in document properties on Document Opening hoping that this could be root cause for the problem, but it doesn’t seem so, as now default values are not selected however they are still the only values that are available in those fields (list box, drop down fields etc.) in Access Point. In Desktop application all field values are visible. This is true even if I add access to see all the data to my user.

Hoping that someone can advice further given this additional information.

[Eliina]

Hello @rubenmarin ,

Thank you for your response. I have tried your suggestions however it didn't really work - same result as previously.

I did try a couple of scenarious:

• Reduced access reduction parametres to 2. Now %AUTHID consists of 2 fields instead of 6 in order to rule out errors in script regarding access combinations.

This also didn't really work - in Access Pint I see only "Current" value in "SnapshotDate" field. But in Desktop application I see all fields - works ok. Users are using Access Point only.

• Added value (user id) in SECTION_ACCESS field for system user who is reloading data on server. Previously it contained value '*'.

When I open application in Access Point it looks like I am opening it with system user, I see all data and user in Access table is system user. Which is incorrect, I should see reduced data.

If I open app in Desktop application it shows data reduction for my user. It these cases both in Access Point and in Desktop "SnapshotDate" field contains all necessary data.

If I do OSuser() it returns my NTNAME in both Access Point and Desktop, but if I do QVuser() it doesn't return any data.

I also tried leaving SECTION_ACCESS, REGION and COUNTRY fields blank for system user, but results are the same - regular user sees all data in Access Point.

Why does access segregation work in Desktop application, but not on server?

In all cases described above and in my original post, user who creates/makes amendments to application in QV Desktop has USER access level and is different from user who reloads application on server. I am opening and doing changes to application with my user, but my user is not reloading application on server.

There is also set up in Dosument Settings - Trigger - OnOpen to set default values for "SnapshotDate" field and some other fields.

I have tried removing the trigger setting hoping that could be the root cause why there is only one value showed in "SnapshotDate" field, however this didn't help. In Access Point those field values are no longer selected, but they are still the only values available in field, where in Desktop application it works and all field values are visible together with proper access reduction.

 Hoping that someone can advice further given this additional information.

[rubenmarin]

Hi @Eliina,note that in access point there is no ADMIN access, every user will have USER access, that can be cause of the different behaviour.

When you entre using NTNAMe there is no QVUser, QvUSER() is when you enter an app not related to ntnames, and it ask user and password before opening the app.

Have you cheched the 2nd option I mentioned to confirm that relations between users and data is the one you are expeting to be?