AD user cannot access Qlik Sense

[Mika_2000]

One of our users (Let's call the user user A) has a very weird issue in Qlik Sense.

Whenever she tries to login to the hub or QMC the user is stuck on the bubble animation as seen below:

We have tried almost everything to solve this issue but we cannot seem to figure it out

What we have tried:

1. We haven given user A a professional license/rootadmin rights, user A still couldn't access the hub or qmc.

2. We have tried to login with a different account on user A's machine and this works. Once we try to login again with user A's credentials she is stuck again on the bubble animation. So we can exclude that this is a connection issue.

3. We have deleted the user A from the AD and added user A again, the same issue occurs.

4. User A has tried to login with her credentials on another machine and she got the same issue that bubble animation keeps loading.

5. We have checked the proxy log files on the server and couldn't find any errors, user A get's authenticated successfully.

6. We have cleared user A's browser cache, cookies and search history.

We are kind of desperate now so any help would be awesome 😄

Thank you in advance.

[Albert_Candelario · Accepted solution]

Hello @Mika_2000 ,

Thanks for posting.

As per my experience this issue is related to the header size, as this particular user might belong to large number of groups on the AD. This is why is user specific.

You need to check: Qlik Sense : "Qlik Sense G3 Broker API" error on t... - Qlik Community - 1711832 and

Qlik Sense HTTP Header size restriction - Qlik Community - 1716332

Let me know if it solves it. 

Cheers,

Albert

[Mika_2000]

Thanks for you fast reply @Albert_Candelario.

I have taken a look at the solutions you provided however this unfortunately doesn't resolve our issue.

We have also turned on debug log files in the qmc and we looked at the log files when the user tries to login.

In multiple log files we get the following error:

89	28.5.0.0	20220725T132503.477+0200	ERROR	vm-qliksense	eaa9fedd-adfd-426b-b678-ca27f8544436	Command=Undefined;Result=403;ResultText=Error: Access denied	c0de4896-532d-4f0f-db69-215c1d95a9dd	62bf0804-e582-4b96-a967-46b23429b56f	0	DOMAIN	userA@directory.com	0	Not available	Repository	AppAccess	/qrs/requestaccesstype	Undefined	403	Access was denied for User: 'DOMAIN\userA@directory.com', SessionId: 'c0de4896-532d-4f0f-db69-215c1d95a9dd', Hostname: ':empty for security reasons', Requested access types: '', OperationType: 'UsageDenied'	eaa9fedd-adfd-426b-b678-ca27f8544436

[Albert_Candelario]

Hello @Mika_2000 ,

Could you also inspect the Dev tools of the browser when the user is opening the HUB and see if we see any more indication there?

Cheers,

Albert

[Mika_2000]

We have taken a look at the dev tools  > network and everything seems to load fine.

According to the Network monitor in the dev tools the hub and everything loads fine but the user is still stuck on the bubble animation.

This makes this issue even more complicated haha.

[korsikov]

	Access was denied for User: 'DOMAIN\userA@directory.com'

It's look very strange.

in my opinion it should look like DOMAIN\userA or userA@Domain.com

[Albert_Candelario]

Well, I am unsure that is the original message or it has been edited by @Mika_2000  in order to make it not data sensitive and able to share it here.

@Mika_2000  could you kindly let us know?

Cheers,

Albert

[Mika_2000]

Thank you @Albert_Candelario and @korsikov,

I indeed edited the username to hide sensitive data.

It is however worth noting that all users sign in with their email and domain.

So is if I (userB) try to login it will look something like this, the same counts for userA.

[Frank_S]

I agree with @korsikov

Unless you have some uniquely defined Active Directory schema,

the login pattern should be domain\userA

not domain\usera@domain.com

My own experience in the past with using the latter also generates access denied.

kind regards...

[Mika_2000]

Thanks for your reply @Frank_S,

We will try to make a new user in the AD and look if this new user can loging.

If there is an update I will let you know!