Security Issue

[#1]

So a customer is having trouble with their security. I was working fine until recently. They are running QV 10 and have

Authentication: Login

Type: Ntlm

Login Address: Alternate login Page

These settings had worked fined when I initially setup the server. Even if I change the authentication to always and default login page, they user is not allowed to login. We modified the  <DefaultUrl>http://_/</DefaultUrl> to port 8080. Any ideas why we are having issues?

[Miguel_Angel_Baeyens]

Hi Alex,

First, are they able to get to the Accesspoint? Are your documents using a section access table with NTNAME within that corresponds to the actual DOMAIN\USERNAME combination for each granted user? And does the QVP://SERVERNAME work?

Check that your browser options (Tools, Internet Options, Security, Custom Level, Automatic Logon...) has the appropriate configuration, so the user is prompted or not and passing his credentials on to the Server.

Did you change anything else apart from the QlikView Server version?

Hope that sheds some light.

Miguel

[#3]

Accesspoint is up and running just fine. But they cannot view any documents as their username and password fail.

Automatic logon only in intranet zone is set. And was not changed ever. You wouldn't think that would affect it now.

[Miguel_Angel_Baeyens]

Hi Alex,

Are all the services running fine in the services.msc console? Does the QVP allow the users to get to the documents? If so, there might something related to the web server / proxy configuration. If the QVP also fails, maybe something related to the Directory Service Connector is going wrong or some account running the service is not working properly?

Hope that helps.

Miguel

[#5]

Okay, so they can go to qvp and view and open the documents. So what could be wrong with web server / proxy configuration?

[#6]

When I click on this. It trys to connect the server on a different domain. Where can I change that?

http://servername:4750/qvws.asmx

[Miguel_Angel_Baeyens]

Hi Alex,

Go to the QlikView Enterprise Management Console, System, Setup, QlikView Web Server, expand and select the web server that is not properly configured.

Note that all those configurations are stored into .xml files within the C:\ProgramData\All Users\QlikTech folder so you may need to check those files for that string and change there manually, if the server does not apply changes. Check as well, in these Web Server tabs, that the paths to the local folders are correct. Sometimes when upgrading there are some paths from older versions left, and QlikView doesn't know where to go.

Hope that helps.

Miguel

[#8]

They havn't upgraded at all. They are running QV10 SR3. Yes we modified the config.xml to change the default url, when we initially installed the software.

But why can we access QVP://SERVERNAME just fine and open the documents that way? That doesn't make sense to me.

[Miguel_Angel_Baeyens]

Alex,

QVP connects directly the client with the Server, avoiding the Web Server. They are two different protocols, and they use two different ports (by default QVP runs in 4747 and Web Server in 80). If the QVP also fails, that means that the client is unable to get to the Server. Then the problems might be associated with network, firewall or proxy software... QVP makes the documents render faster, since there is no tunnelling nor any other transformation, and the data flows directly from client to Server and vice versa.

But when QVP works, the client can indeed connect to the Server, so the problem must be in the Web Server. There's not a unique answer for this issues. You mentioned above that you changed port to 8080 which is a very usual proxy port. If you are running some proxy software in your network, your NAT routers might not know where to go, or have a fixed or default address... I always test with higest, more unknown ports, unlikely to be in use by other services like 50600 or 65123.

The Web Server is slower, irrespective the client you use to render, since it needs to encapsulate the data, which takes longer CPU time and more memory usage. The Web Server might have a different name because of the DNS, some issues with the port 80 that might be in use by, say, a corporate IIS server, paths that have been moved... The QEMC tabs to check are System, Setup, QlikView Server and Web Server.

The last issue I fixed related to the Server was about folders in the Web Server. For some reason, the QEMC was still keeping two different paths (for version 9 and 10, that was not an upgrade since version 9 was completely removed from the server and all folders moved to a backup). Users could connect by QVP anyway, because the Server was running up and fine, and they had open port 4747.

Hope that makes sense and helps.

Miguel

[#10]

Okay, thanks for the explanation. Now, what would cause the web server to somehow stop working? Could another application been started and is now using the QV Web Server Port? Do you think upgrading to SR4 would help at all?