topic Re: Setting up security with Active Directory - is it Section Access or in the QlikView Server? in QlikView

Setting up security with Active Directory - is it Section Access or in the QlikView Server?

Wed, 29 Oct 2014 09:49:03 GMT

Hi all,

How can a large organisation align their QlikView application to have security that is the same as their logins for computers?

E.g. We want to set-up users so that the applications require same login ID's and passwords as what they use to login into the company network.

How can that be approached?

Re: Setting up security with Active Directory - is it Section Access or in the QlikView Server?

simondachstr — Wed, 29 Oct 2014 09:51:23 GMT

You can apply Section Access based on NTName. Even more secure, you can apply file system security on document level, however you will still need section access in case you want to reduce the dataset based on the user.

Re: Setting up security with Active Directory - is it Section Access or in the QlikView Server?

Gysbert_Wassenaar — Wed, 29 Oct 2014 09:55:04 GMT

You can use AD for authentication only. Section Access can use AD to authenticate users and then apply the authorizations that you've defined in some source table. That authorizations table can be an excel file, a database table or an inline table defined in the script.

See this document for more information about section access: Introduction to Section Access

Re: Setting up security with Active Directory - is it Section Access or in the QlikView Server?

ashfaq_haseeb — Wed, 29 Oct 2014 09:57:09 GMT

Hi,

Go for section access with NT authorization

Regards

ASHFAQ

Re: Setting up security with Active Directory - is it Section Access or in the QlikView Server?

Thu, 15 Jan 2015 14:12:28 GMT

Hi,

We have over 400 users in an AD group which we need to give access to. Is it possible to add this group to the Document Cal's list and tick the 'Allow Dynamic Cal Assignment' box? I have tried this but my users are getting error messages :

'Access Denied. The Server (servname) has no UserCal for your account. Please contact your system administrator'

The only way a user has managed to access the document is if I put them in as an individual.

Any help appreciated!!

Best Wishes

Re: Setting up security with Active Directory - is it Section Access or in the QlikView Server?

Thu, 15 Jan 2015 14:27:13 GMT

Did you check also Allow license lease?

Re: Setting up security with Active Directory - is it Section Access or in the QlikView Server?

Thu, 15 Jan 2015 14:47:32 GMT

where can I find this?

Hi I have just seen that this is already checked in QMC

Hope this helps

Re: Setting up security with Active Directory - is it Section Access or in the QlikView Server?

Thu, 15 Jan 2015 14:55:06 GMT

Should be just above 'Allow Dynamic Cal Assignment'.

In QMC, System -> Licenses -> QlikView Server -> CALs -> General

Re: Setting up security with Active Directory - is it Section Access or in the QlikView Server?

Thu, 15 Jan 2015 15:17:29 GMT

Can you also check if any of the people which are in the Assigned CALs get this error. Or the error is for all the other users?

As I see, you have all your Named CALs assigned.

Re: Setting up security with Active Directory - is it Section Access or in the QlikView Server?

Thu, 15 Jan 2015 15:41:20 GMT

I believe all those with named cals can access the document. As a test I asked a colleague with named cal to access it - he could. Also, I unchecked Allow Dynamic Cal Assignment and he could still access it.

Thanks,

Tom

Re: Setting up security with Active Directory - is it Section Access or in the QlikView Server?

Thu, 15 Jan 2015 15:45:26 GMT

I think the problem is that you don't have any free licenses. You can't really go around it...

What you can also do, is remove from time to time from those 13 Named Calls the ones which are not using QlikView anymore. Keep in mind, that removing a license that way will take 24 hrs since the last log in of that user. So it can be almost instant, or it can take some time.

Or you can get buy some new licenses for your server.

Re: Setting up security with Active Directory - is it Section Access or in the QlikView Server?

Thu, 15 Jan 2015 15:51:10 GMT

I don't think we can remove the Named Cals as these (myself) included are used to edit / develop documents.

We have over 500 Document Cals available - are you able to explain the difference ?

Thanks again.

Re: Setting up security with Active Directory - is it Section Access or in the QlikView Server?

Thu, 15 Jan 2015 15:57:01 GMT

You can use those Document Calls then. You should allocate enough Document Calls to each file that is going to be accessed. I can't really remember the exact place in the Documents tab where you can manage that. Can you have a look there? On the server I'm working now, we don't use Document Calls.

Re: Setting up security with Active Directory - is it Section Access or in the QlikView Server?

flipside — Thu, 15 Jan 2015 16:06:14 GMT

According to this thread http://community.qlik.com/message/642132#642132 you cannot allocate CALs to a group. I tried it recently with a custom group and that didn't work either. You CAN specify the group on the Authorization tab which permits them to see the QV document listed in AccessPoint, but that's not much help to your situation.

I'm surprised this isn't permitted.

flipside

Re: Setting up security with Active Directory - is it Section Access or in the QlikView Server?

Thu, 15 Jan 2015 16:08:16 GMT

Thanks for your replies. Thats the problem, I've allocated 150 of Document Cals to the document and selected 'Allow dynamic CAL assignment'. I've also added the AD group into the list of Assigned Users... but I'm getting errors from the users within that AD group when they try and access it. Any ideas???

Cheers,

Tom

Re: Setting up security with Active Directory - is it Section Access or in the QlikView Server?

Thu, 15 Jan 2015 16:10:15 GMT

Hi Thanks for your reply.. Can you point me in the direction of the Authorization tab?

Re: Setting up security with Active Directory - is it Section Access or in the QlikView Server?

flipside — Fri, 16 Jan 2015 08:51:15 GMT

Sure. It's in the QMC, Documents tab, click a document and it's the second tab along. It's at the same level as the tab where you allocate Document CALs. Seeing as you say that when you allocate a CAL to a specific user and they do then have access, then the group is probably already set.

Going back to your original problem, you can add and remove users using the QV Power Tools (http://community.qlik.com/message/184788#184788). I haven't done this myself but it should just be a case of exporting the users from the AD group into a file (you can connect to AD using Qlikview via OLEDB connection) then using qv-user-manager to import them in. Maybe someone else who manages a large number of users can confirm this or speak to your QV account manager.

Hope this helps

flipside