topic Re: Problem with kerberos authentication in QlikView

Problem with kerberos authentication

peterwh — Mon, 26 Jan 2026 18:19:17 GMT

Hello,

I've tried to activate kerberos in our QlikView-Environment. I used this documentation: https://community.qlik.com/t5/Official-Support-Articles/Kerberos-support-using-QlikView-Webserver/ta-p/1710991

I changed the config.xml and "setspn" was executed. But if I try to open the AccessPoint I get "Login failed". I've used Edge und Firefox and both show the same error message.

Does anyone have an idea what could be wrong? Which log-files could be relevant (unfortunately I didn't find one that shows me more details)?

I know I ask where unspecific, but I didn't find a startingpoint yet for further investigation.

Our server are Windows 2016 and we're using QlikView May 2023SR1.

Kind regards

Peter

Re: Problem with kerberos authentication

Chip_Matejowsky — Thu, 14 Mar 2024 21:40:12 GMT

Hi @peterwh,

See if you can reproduce issue while recording a .HAR file as described in article Save network web traffic (HAR/XML file) and console logs from the browser's developer tools. It may help in determining what the issue is.

Best Regards

Re: Problem with kerberos authentication

peterwh — Thu, 21 Mar 2024 06:56:25 GMT

Hello,

thanks for your answer. Due to my current workload I couldn't test it. If I have new insights I will post them.

Kind regards

Peter

Re: Problem with kerberos authentication

peterwh — Tue, 20 Jan 2026 15:11:43 GMT

Hello,

sorry for the late response, but now I've had the chance to investigate my problem further. This is what I've found:

We have three (legacy) domains which trust each other. There is a forth domain which doesn't have a full trust. Which trust exactly, I don't know.

The four domains are configured in DSC via "Active Directory" and "LDAP://<domain>".

If I use NTLM users from every domain can logon to the AccessPoint and use QlikView-dashboards.

If I switch to "Negotiate" only user from the three "legacy"-domains can logon successfully. The users of the forth domain get "Login failed".

Does anyone have a glue, what could be the problem and how to solve it?

Kind regards

Peter

Re: Problem with kerberos authentication

Chip_Matejowsky — Tue, 20 Jan 2026 19:56:55 GMT

Hi @peterwh,

I believe a domain trust with the fourth domain would be a requirement. Have a look at the following articles:

Best Regards

Re: Problem with kerberos authentication

peterwh — Wed, 21 Jan 2026 05:57:59 GMT

Hello @Chip_Matejowsky,

I will ask the IT department which trust relationship exists between the "legacy" domains and the new domains.

But why is everything working as expected if I use NTLM and not if I use "Negotiate"? That's the point I don't understand. All four domains are configured within the DSC config (see attached screenshot). The ones without a password are the "legacy" domains, the last one is the new domain.

I forgot to mention we use QlikView May 2024SR1.

Kind regards

Peter

Re: Problem with kerberos authentication

peterwh — Fri, 23 Jan 2026 11:25:01 GMT

Hello @Chip_Matejowsky,

I talked to our IT department and they said there is a "selective" trust between the domains. So not all users or service can communicate.

They modified a configuration so that our service user has the right to use kerberos and now I can access the QVWebserver from all four domains.

Thank you for your time investment.

Kind regards

Peter