topic Re: AD user cannot access Qlik Sense in Management & Governance

AD user cannot access Qlik Sense

Mika_2000 — Fri, 22 Jul 2022 09:30:36 GMT

One of our users (Let's call the user user A) has a very weird issue in Qlik Sense.

Whenever she tries to login to the hub or QMC the user is stuck on the bubble animation as seen below:

We have tried almost everything to solve this issue but we cannot seem to figure it out

What we have tried:

1. We haven given user A a professional license/rootadmin rights, user A still couldn't access the hub or qmc.

2. We have tried to login with a different account on user A's machine and this works. Once we try to login again with user A's credentials she is stuck again on the bubble animation. So we can exclude that this is a connection issue.

3. We have deleted the user A from the AD and added user A again, the same issue occurs.

4. User A has tried to login with her credentials on another machine and she got the same issue that bubble animation keeps loading.

5. We have checked the proxy log files on the server and couldn't find any errors, user A get's authenticated successfully.

6. We have cleared user A's browser cache, cookies and search history.

We are kind of desperate now so any help would be awesome 😄

Thank you in advance.

Re: AD user cannot access Qlik Sense

Albert_Candelario — Sat, 23 Jul 2022 17:49:31 GMT

Hello @Mika_2000 ,

Thanks for posting.

As per my experience this issue is related to the header size, as this particular user might belong to large number of groups on the AD. This is why is user specific.

You need to check: Qlik Sense : "Qlik Sense G3 Broker API" error on t... - Qlik Community - 1711832 and

Qlik Sense HTTP Header size restriction - Qlik Community - 1716332

Let me know if it solves it.

Cheers,

Albert

Re: AD user cannot access Qlik Sense

Mika_2000 — Mon, 25 Jul 2022 12:55:17 GMT

Thanks for you fast reply @Albert_Candelario.

I have taken a look at the solutions you provided however this unfortunately doesn't resolve our issue.

We have also turned on debug log files in the qmc and we looked at the log files when the user tries to login.

In multiple log files we get the following error:

89 28.5.0.0 20220725T132503.477+0200 ERROR vm-qliksense eaa9fedd-adfd-426b-b678-ca27f8544436 Command=Undefined;Result=403;ResultText=Error: Access denied c0de4896-532d-4f0f-db69-215c1d95a9dd 62bf0804-e582-4b96-a967-46b23429b56f 0 DOMAIN userA@directory.com 0 Not available Repository AppAccess /qrs/requestaccesstype Undefined 403 Access was denied for User: 'DOMAIN\userA@directory.com', SessionId: 'c0de4896-532d-4f0f-db69-215c1d95a9dd', Hostname: ':empty for security reasons', Requested access types: '', OperationType: 'UsageDenied' eaa9fedd-adfd-426b-b678-ca27f8544436

Re: AD user cannot access Qlik Sense

Albert_Candelario — Mon, 25 Jul 2022 12:58:27 GMT

Hello @Mika_2000 ,

Could you also inspect the Dev tools of the browser when the user is opening the HUB and see if we see any more indication there?

Cheers,

Albert

Re: AD user cannot access Qlik Sense

Mika_2000 — Mon, 25 Jul 2022 13:05:18 GMT

We have taken a look at the dev tools > network and everything seems to load fine.

According to the Network monitor in the dev tools the hub and everything loads fine but the user is still stuck on the bubble animation.

This makes this issue even more complicated haha.

Re: AD user cannot access Qlik Sense

korsikov — Tue, 26 Jul 2022 13:25:55 GMT

	Access was denied for User: 'DOMAIN\userA@directory.com'

It's look very strange.

in my opinion it should look like DOMAIN\userA or userA@Domain.com

Re: AD user cannot access Qlik Sense

Albert_Candelario — Tue, 26 Jul 2022 19:42:27 GMT

Well, I am unsure that is the original message or it has been edited by @Mika_2000 in order to make it not data sensitive and able to share it here.

@Mika_2000 could you kindly let us know?

Cheers,

Albert

Re: AD user cannot access Qlik Sense

Mika_2000 — Wed, 27 Jul 2022 06:14:39 GMT

Thank you @Albert_Candelario and @korsikov,

I indeed edited the username to hide sensitive data.

It is however worth noting that all users sign in with their email and domain.

So is if I (userB) try to login it will look something like this, the same counts for userA.

Re: AD user cannot access Qlik Sense

Frank_S — Wed, 27 Jul 2022 20:03:54 GMT

I agree with @korsikov

Unless you have some uniquely defined Active Directory schema,

the login pattern should be domain\userA

not domain\usera@domain.com

My own experience in the past with using the latter also generates access denied.

kind regards...

Re: AD user cannot access Qlik Sense

Mika_2000 — Fri, 29 Jul 2022 12:49:36 GMT

Thanks for your reply @Frank_S,

We will try to make a new user in the AD and look if this new user can loging.

If there is an update I will let you know!

Re: AD user cannot access Qlik Sense

Albert_Candelario — Fri, 29 Jul 2022 14:28:59 GMT

Great @Mika_2000 , let us know!

Re: AD user cannot access Qlik Sense

Frank_S — Fri, 29 Jul 2022 14:44:54 GMT

Sounds good

However, note that on the user's first access attempt (using this format domain\usera), they may see an access denied. Once they mention this to you, it is time to go into the QMC to, look for 'domain\usera' (which will now be visible in the QMC) in the user list, then assign a license. Depending on your license model, you will need check the relevant to your environment steps below...

To enable dynamic leasing in the analyzer/professional license model, you may use:

Enabling dynamic license assignment

Kind regards...

Re: AD user cannot access Qlik Sense

Mika_2000 — Mon, 01 Aug 2022 06:29:10 GMT

Thanks for the heads up @Frank_S!

We are aware of this 🙂

Re: AD user cannot access Qlik Sense

Mika_2000 — Thu, 04 Aug 2022 06:27:15 GMT

Hello @Frank_S and @Albert_Candelario,

We have created a new user in the AD and this user can log into the environment just fine.

I have created a whole new server and Qlik environment with the virtual proxy we are using on the live environment to see if maybe the PostgreSQL database was corrupt on the live environment.

However the same issue occurs, all other users can login just fine and acces the hub. UserA gets the problem that the bubble animation just keeps on looping...

Our client is using HelloId to manager users, maybe there is something wrong in the configuration for this specific user?

Re: AD user cannot access Qlik Sense

Albert_Candelario — Thu, 04 Aug 2022 08:16:26 GMT

Hello @Mika_2000 ,

At this stage it looks like it, that there is something wrong with this user profile, would it be possible to recreate the user itself?

Thanks for keeping us updated.

Cheers,

Albert

Re: AD user cannot access Qlik Sense

Mika_2000 — Fri, 05 Aug 2022 07:56:11 GMT

Hi @Albert_Candelario,

Unfortunately we are not in charge of the AD, our customer's system admin does not want to delete the user and add them again because that requires a lot of administration he says (we do not agree with this but it is what it is ☹️). We have created a support case at Qlik, bellow I have posted the support case bellow and once again filtered out all the sensitive information.

'Hi Qlik Support,

One of our customers has a weird issue whenever the user tries to access the Qlik Sense Hub she gets stuck on the bubble animation whenever the hub loads. It does not matter how long the user waits the bubble animation keeps on playing and the user cannot enter the hub.

In this environment users are stored in a AD group in Azure with HelloId. Every user can access the hub except for userA@domain.nl and userB@domain.nl.
We have all tried the following,

-Deleted both the users from the tab 'Users' in the Qlik Sense QMC, the users logged in again and the user appeared in the list of users in the QMC but they still do not have access to the Qlik Sense Hub or QMC. They where still stuck on the bubble animation.

-On the machine of the user we have checked that the ports in their firewall are open for outbound/inbound rules. These ports are open and the user's machine should be able to make a connection with the server where Qlik Sense is running. We have also tried to connect to the server via the Test-NetConnection command in PowerShell. The machine of the user is able to make a connection with the server.

-We have given both users RootAdmin rights and allocated them a professional access license, the users are still unable to access the hub and are stuck on the bubble animation.

-Both users have tried to login with their credentials on another machine and they got the same issue that bubble animation keeps playing.

-We have turned on debug logs in the QMC and have examined these files, we could not find any errors we think are causing these problems. (there are errors but users who can access the hub get the same errors). We have attached the log files as an attachment.

-On the environment where both users are stuck on a bubble animation all users get authenticated via a virtual proxy with SAML (see image). We have made a new clean environment with Qlik Sense May 2021 Patch 1 - 14.20.6 and copied the exact same virtual proxy our client uses on their live environment onto our test environment. Both the users are still unable to access the hub in the test environment, while all other users are able to access the hub of the test environment.

-As a work around we have created two users on the server. These users are called VM-QLIKSENSE\userA and VM-QLIKSENSE\userB, both users are able to access the hub via https://qliksense.default-custommer.nl/login. Not via https://qliksense.default-custommer.nl this work around is temporary because both users can access the server with these credentials.

We are kind of desperate because we have tried everything on our side, could you please help us?
Thank you in advance!'

Re: AD user cannot access Qlik Sense

jgtaekema — Wed, 17 May 2023 08:35:10 GMT

Hello,

Last september I had the same problem with just one user. We just started using QlikSense at that time (QlikView before). Then we installed an update of QlikSense and the problem was gone somehow. Now we installed the next update of QlikSense and the problem is back! We tried so many things, all which you have described. The user has URL's to specific QlikSense apps and that works fine. It's the hub that keeps animating. But now we have installed the latetst QlikSense version, we ar quite despirate, we don't know what to do anymore. Did you get an answer from Qlik? Is your problem solved?

Re: AD user cannot access Qlik Sense

jgtaekema — Wed, 15 Nov 2023 12:28:37 GMT

The answer lies in the max http headersize (for us). This topic lists our solution: https://community.qlik.com/t5/Official-Support-Articles/Qlik-Sense-Client-Managed-Adjust-the-MaxHttpHeaderSize-for-the/ta-p/2107101