Login Failed Result=403

[derrydavis]

Hi All,

Having a couple of issues with users logging into Qlik Sense. The server is connected to an Active Directory and synching properly. There is an LDAP filter in place for groups and specified users. This works correctly for users except for a couple of individuals.

When they try to login they are denied access and the following messages are entered into the logs - Command=Login;Result=403;ResultText=Error: Access Denied

-Login failed for user 'domain\id' wrong credentials?

They have been configured correctly with access and allocated a license. 

Accounts are not 'Inactive', 'Blocked' or 'Removed Externally'. 

Any ideas what to check next or why this may be happening? Thanks in advance

[Seanog_Murphy]

Hi @mder,

Can you please verify that all users are returned if you query the AD using an LDAP admin tool as described in the article here:
- https://community.qlik.com/t5/Knowledge/Qlik-Sense-on-Windows-Configuring-and-testing-LDAP-filters-f...

[derrydavis]

Hi Seanog_Murphy,

Yes, one of the users does show up when querying the ad using an admin too. Attached a screenshot. User does not have issues logging into other services with the credentials.

Thanks.

[Seanog_Murphy]

Hi @derrydavis,

I can see the error in the screenshot but I would like to ensure that the LDAP filter is correctly pulling the user. This can be verified outside of Qlik using the admin tool. If the user exists in the AD and the LDAP filter is correctly configured, then Qlik should grant them access.

If you are certain that this is the case, perhaps it would be useful to check the network developer tools to see if you can get a more specific error message.
- https://community.qlik.com/t5/Knowledge/Save-network-web-traffic-HAR-XML-file-and-console-logs-from-...

[derrydavis]

Thank you, will work on getting this information. I seem to forget about the browser dev tools.

[derrydavis]

Log file details, reviewing .har file now.

DevTools failed to load source map: Could not load content for https://login.microsoftonline.com/0ee6c63b-4eab-4748-b74a-d1dc22fc1a24/oauth2/e0d8544d7d0b7a5944bb.m...:
HTTP error: status code 404, net::ERR_HTTP_RESPONSE_CODE_FAILURE

[derrydavis]

Ok, capture a .har file and using fiddler to review it there is a result that shows the login page for the user and it shows a message box saying 'JavaScript is disabled. Some functionality will not work as eexpected if JavaScript is disabled.' 

Checking with user if the browser is disabling javascript.

[derrydavis · Accepted solution]

Circling back to this one and closing it out. The issue was that the user account required a password update but wasn't prompting the user to change it.