topic Re: Problem with header authentication, AD groups and section access in QlikView

Problem with header authentication, AD groups and section access

Anonymous — Mon, 26 Jan 2026 18:19:17 GMT

Hello everyone,

I am trying to setup a Qlikview 10 server with:

HTTP header authentication (in conjunction with a SSO system)
Active Directory integration for group resolution (with Directory Service Connector)
Section Access to restrict application usage to specific groups

My problem is that it does not work. As a user U, member of group G, I can open a Qlikview application if user U is listed in Section Access but i cannot open the same Qlikview application if the group G is listed in Section Access instead.

As the SSO system returns user names with no domain, we have configured the Qlikview Web Server to use header authentication with the AD domain as a prefix : "DOMAIN\". With this configuration, on the top right corner of the Accesspoint I can see a fully qualified user name : DOMAIN\USER instead of only USER.

In the Directory Service Connector logs we can also see that group resolution is working for the user DOMAIN\USER. And as a result, the list of applications shown in the Accesspoint is correct.

But when I try to open my application, Qlikview asks me for a USERID and PASSWORD...

Do you see an explanation for this to happen?

Best regards,

Damien

Problem with header authentication, AD groups and section access

Anonymous — Mon, 02 Apr 2012 18:27:28 GMT

Any help ? Suggestion ?

Problem with header authentication, AD groups and section access

Bill_Britt — Mon, 02 Apr 2012 20:15:02 GMT

Asking for USERID and PASSWORD is section access. To pass your ID you need to configure your section access correctly.

Re: Problem with header authentication, AD groups and section access

Anonymous — Tue, 03 Apr 2012 08:56:23 GMT

Hi Bill and thank you for answering.

Actually, my section access seems to be correctly configured but I use NTNAME instead of USERID and PASSWORD.

I use 2 QVW files for testing. One with Section Access like this:

LOAD * INLINE [
     ACCESS, NTNAME
     USER, my_domain\MY_USER_NAME
];

And a second one with Section Access like this:

LOAD * INLINE [
     ACCESS, NTNAME
     USER, MY_DOMAIN\MY_GROUP_NAME
];

These two files open nicely on local client (standard NT authentication) but only the first one opens when accessed through the server (with header authentication).

Damien

Re: Problem with header authentication, AD groups and section access

Tue, 03 Apr 2012 09:15:37 GMT

Hi Damien

I think the problem migh be that you can't use your domain as a prefix to the username when using header authentication as QlikView will try validate the user against the AD which it can't because its simply receiving a username not pass through authentication. Try prefix the username with "CUSTOM\" instead which QlikView considers to be its own custom directory service.

Matt

Re: Problem with header authentication, AD groups and section access

Anonymous — Tue, 03 Apr 2012 10:01:39 GMT

Hi Matt and many thanks for your answer.

I managed to make it work by changing the prefix as you suggested but I did not use "CUSTOM\"...

I simply changed "my_domain_name\" to "MY_DOMAIN_NAME\" and everything works like a charm now

Bye!

Re: Problem with header authentication, AD groups and section access

Tue, 03 Apr 2012 10:11:33 GMT

Ah yes, QV is a little funny about having domains, etc in uppercase. Glad it's working now!

Matt