topic Re: DMS with AD & custom groups = empty accesspoint in QlikView

DMS with AD & custom groups = empty accesspoint

Peter_Cammaert — Mon, 26 Jan 2026 18:19:17 GMT

At a customer of ours, we're building a specific authorization mechanism using QVS EE, QVP and DMS (all on same server running QV11IR). Users are authenticated using AD and recognized by way of the Active Directory DSC. A Configurable ODBC provides custom groups for all users that should have access to the documents in the portal.

We can query these users in the QMC Users tab. They appear to belong to both the correct AD groups AND the custom groups that were defined in an Oracle DB.

When we create a distribution task for reloading and distributing a single document to a custom group, the QMC confirms (via the same Users menu) that the document is reloaded and distributed to this custom group. Selecting a single member in the QMC->Users list produces confirmation that the user belongs to the distribution group (Groups tab), has access to the correct test document (Documents tab) and got the necessary rights from the correct task because of being a member of this custom group (Distribution tab).

However, when the same lucky user opens the portal, no documents are available. Just an empty list...

No error messages or warnings are present in the logs. All DSC activity is successful.

The QVWS log contains the only indicator that something is wrong. The GetAdminDocListForUser request consistently returns an empty list.

BTW this user has all necessary NTFS rights to folders and documents, but I don't think that matters when using DMS.

Is there a reason why QMC keeps telling everything's just fine when the published documents remain invisible in the AccessPoint?

Thnx,

Peter

Re: DMS with AD & custom groups = empty accesspoint

danielrozental — Mon, 10 Sep 2012 14:40:41 GMT

Not really sure what the problem might be but you could check a couple of things, is the directory service connector configured correctly in the QVWS settings?

Have you tried setting the DSC log level to debug? that may offer more information.

Re: DMS with AD & custom groups = empty accesspoint

Peter_Cammaert — Mon, 10 Sep 2012 18:33:29 GMT

Hi Daniel.

Yes, the DSC is correctly configred. Other users that have been authorized by name can view and open their documents without any problem. Just the authorizations through custom groups fail to work. E.g. a user with 3 documents with domain\user authorization and one document with domain\customgroup authorization sees only 3 documents. The QMC says otherwise (access to four documents).

Yes I have. All logs are either in verbose or in debug mode. But that isn't helping much as QVS isn't aware of any problem whatsoever...

QVWS is simply telling me that there aren't any documents for this user. DSC resolves users and groups, and then... silence.

Peter

Re: DMS with AD & custom groups = empty accesspoint

danielrozental — Mon, 10 Sep 2012 18:38:16 GMT

If you're using an oracle database, can you check the queries that are being done are correct? have you tried the group without the domain?

I'm not really sure you can have groups from one source and users from another. Not sure how that works.

Re: DMS with AD & custom groups = empty accesspoint

Bill_Britt — Mon, 10 Sep 2012 19:00:12 GMT

You can't use Custom Users with any other directory service. So, you either will have to run Custom Users or AD.

Bill Britt

Re: DMS with AD & custom groups = empty accesspoint

danielrozental — Mon, 10 Sep 2012 19:02:36 GMT

Bill, I think he's trying to use AD users with groups defined in a Configurable ODBC.

Re: DMS with AD & custom groups = empty accesspoint

Bill_Britt — Mon, 10 Sep 2012 19:09:39 GMT

Thanks Daniel I read that wrong.

QlikView will use the different LDAP to setup the rights to the documents. This has nothing to do with Authentication. QlikView only support Windows Authentication and if you are using anything else you have to create(write) the SSO pages to pass the header information to QlikView.

Bill Britt

Re: DMS with AD & custom groups = empty accesspoint

Peter_Cammaert — Tue, 11 Sep 2012 06:39:51 GMT

Correct Daniel. I know that I cannot mix up AD users and Custom users. But I can use "custom groups" (bad name) from a Configurable ODBC together with AD users and groups.

In QMC Users->Groups, everytime I select an AD user, QMC shows me both the AD groups and the custom groups this user belongs to. "Seems" to work well.

Peter

Re: DMS with AD & custom groups = empty accesspoint

Peter_Cammaert — Tue, 11 Sep 2012 06:49:28 GMT

Bill, authentication is working correctly everywhere and we don't use anything else than AD.

Even in the AccessPoint an AD user from a custom group is recognized and has his name shown at the top. It's the authorization part that goes numb. No documents shown, while the QMC says I should see at least one QVW because of custom group membership...

It's like in this case the QVWS cannot get QVS to deliver the names and thumbnails of the documents the user is authorized to view.

OR, QMC is telling me stuff that everybody else in the QlikView services family is convinced that it can't be done...

Peter

Re: DMS with AD & custom groups = empty accesspoint

Peter_Cammaert — Tue, 11 Sep 2012 06:58:42 GMT

Daniel, I'll try the Oracle query trace.

Just to be sure: when using DMS, authorizations for specific documents are stored in meta files alongside the documents themselves. If QVS stores the original authorizations, the name of that single custom group should be there and whenever QVWS asks for authorized documents, DSC must determine group membership for the visiting user at the time of the request, correct?

More info will follow.

Peter

Re: DMS with AD & custom groups = empty accesspoint

danielrozental — Tue, 11 Sep 2012 11:03:25 GMT

No, I don't think that's the way it works. DSC queries de database every 15 minutes (or similar) and fetches information about groups.

Maybe that acts as a cache, not really sure what records does the DSC pull.

Sorry, I don't really know that but if you learn anything else please post it.

Re: DMS with AD & custom groups = empty accesspoint

Bill_Britt — Tue, 11 Sep 2012 13:15:19 GMT

Peter, If you are not doing Windows Authentication you have to write a SSO application that will do the Authentication for you and then it will pass the Header information to QV. Once that is passed to QlikView we will use the header information to see what you have rights two. Look at the attracted document on how to pass and setup QlikView to use Header. I used Customer Users here because I didn't have access to anyother LDAP.

Bill

Re: DMS with AD & custom groups = empty accesspoint

Peter_Cammaert — Tue, 11 Sep 2012 13:38:10 GMT

Bill, I'm using only Windows authentication. See first sentence of msg 8. AD = Active Directory.

Users authenticate themselves by preference using IWA, so SSO leads them straight away to their AccessPoint document list. At that point authorizations kick in and those are returning empty or partial document lists. All rather unexpectedly.

Authentication is working just fine.

Peter

Re: DMS with AD & custom groups = empty accesspoint

Bill_Britt — Tue, 11 Sep 2012 13:39:31 GMT

Then you can't use Custom LDAP. You have to use Windows. With any other you have to write a SSO to make it work.

Re: DMS with AD & custom groups = empty accesspoint

Peter_Cammaert — Tue, 11 Sep 2012 14:24:58 GMT

I guess you mean Configurable LDAP? Then I'm not using a Custom LDAP.

I'm using Windows AD, consisting of the following DSP's:

- Active Directory (for domain accounts)

- Local Directory (for accounts on the server machine)

On top of that, I'm using Configurable ODBC just for group resolution. Configurable ODBC doesn't do anything else. These groups only match users from the Active Directory DSP (because of the required Directory Label)

I'm not using a Custom Directory, as that would cause a big malfunction.

Peter

Re: DMS with AD & custom groups = empty accesspoint

Peter_Cammaert — Thu, 20 Sep 2012 07:52:57 GMT

Wow.

It seems that QVS can manage users purely on customized ODBC.

By way of experiment, I assigned licenses to a few AD users. Then I dropped all DSPs except customized ODBC. Now there are just the users (& groups) defined in the ENTITY table.

The group membership resolution still doesn't work (no documents in portal)
But if I now authorize a Customized ODBC user to view a document in AccessPoint (User Docs->Authorizations), and this user has by any chance a correponding AD account, the document does appear in QlikView AccessPoint.

Is the communication between QVWS and QVS about who can see which documents based on text IDs only (like the string "DOMAIN\username") instead of some kind of secure token?

Peter

Re: DMS with AD & custom groups = empty accesspoint

Peter_Cammaert — Thu, 20 Sep 2012 13:25:41 GMT

Apparently, AD users and custom groups cannot be mixed. QMC has no problem resolving custom groups for AD users, but QVWS won't. So you won't get to your documents, unfortunately.

Those who want this to happen in a future release can vote for: http://community.qlik.com/ideas/1851

Thanks for your feedback

Peter

Re: DMS with AD & custom groups = empty accesspoint

chriscammers — Thu, 16 Feb 2023 19:59:30 GMT

@Bill_Britt

I know I am kicking a really old thread but I have a client trying to set up QlikView for external users. They have a working odbc dsc, a working Ticket authentication solution with Okta as the IDP. We we attempt to set user permissions based on our groups in the ODBC dsc we don't get any apps if we assign permissions based on our users then we get apps.

Are permissions granted at the group level really not supported with an external IDP???

And yes, I am trying to convince them to move to Sense but my they hate it and have tons of development invested in their qlik apps. This would all be easier there.