Service User Access Denied - Non Existing ID & NoAvailableAccessType

[ift_isabelle]

Hi,

I was checking the performance of our server today and I noticed something weird in the operations monitor.
Every hour, our serviceuser tries to access something which I cannot find on the server. Any idea how I can find this and end this type of behaviour?

Service user has a valid User access pass.
Strange enough our Monitoring app reload at the exact same time.
Don't know if that is coincedence or not.

Kind Regards,

Isabelle Timmermans

Proxy	ERROR	Access to app '__hub' denied, result code 'NoAvailableAccessType'	4.425	2019-03-27 07:54:43
Repository	ERROR	Access was denied for User: '<DOMAIN\Serviceuser>', with AccessID '51949305-5082-4ec6-a8db-e0e34ac0eb6d', SessionID: '5e74cee8-efc0-46ce-a62a-8c13551d5a05', SessionCount: '5', Hostname: '::1', OperationType: 'UsageDenied'	1	2019-03-27 07:54:43
Repository	ERROR	Access was denied for User: '<DOMAIN\Serviceuser>', with AccessID '51949305-5082-4ec6-a8db-e0e34ac0eb6d', SessionID: 'bff39228-5bf7-4fcc-ba75-b920d44f5662', SessionCount: '5', Hostname: '::1', OperationType: 'UsageDenied'	1	2019-03-27 07:54:41
Proxy	ERROR	Access to app 'object' denied, result code 'NoAvailableAccessType'	632	2019-03-27 07:54:34
Repository	ERROR	Access was denied for User: '<DOMAIN\Serviceuser>', with AccessID '51949305-5082-4ec6-a8db-e0e34ac0eb6d', SessionID: '746651d9-3b66-4568-9115-9ce4ad26c343', SessionCount: '5', Hostname: '::1', OperationType: 'UsageDenied'	1	2019-03-27 07:54:34
Proxy	ERROR	Access to app 'full' denied, result code 'NoAvailableAccessType'	1.264	2019-03-27 07:54:33
Repository	ERROR	Access was denied for User: '<DOMAIN\Serviceuser>', with AccessID '51949305-5082-4ec6-a8db-e0e34ac0eb6d', SessionID: '5c3bca75-b5a2-4308-b6d1-b5e5e42da87c', SessionCount: '5', Hostname: '::1', OperationType: 'UsageDenied'	1	2019-03-27 07:54:33
Repository	ERROR	Access was denied for User: '<DOMAIN\Serviceuser>', with AccessID '51949305-5082-4ec6-a8db-e0e34ac0eb6d', SessionID: '27c97373-3f67-43d2-88d1-39f6038fd849', SessionCount: '5', Hostname: '::1', OperationType: 'UsageDenied'	1	2019-03-27 07:54:30
Repository	ERROR	Access was denied for User: '<DOMAIN\Serviceuser>', with AccessID '51949305-5082-4ec6-a8db-e0e34ac0eb6d', SessionID: '18a4e0b6-abaf-4d15-a917-d35745e9155e', SessionCount: '5', Hostname: '::1', OperationType: 'UsageDenied'	1	2019-03-27 07:53:32
Repository	ERROR	Access was denied for User: '<DOMAIN\Serviceuser>', with AccessID '51949305-5082-4ec6-a8db-e0e34ac0eb6d', SessionID: '37436f9d-2476-4aec-81a1-6a32d736fb8f', SessionCount: '5', Hostname: '::1', OperationType: 'UsageDenied'	1	2019-03-27 07:53:31
Repository	ERROR	Access was denied for User: '<DOMAIN\Serviceuser>', with AccessID '51949305-5082-4ec6-a8db-e0e34ac0eb6d', SessionID: '6de1f735-4c05-4074-a2a7-1a24574edbe7', SessionCount: '5', Hostname: '::1', OperationType: 'UsageDenied'	1	2019-03-27 07:53:28
Repository	ERROR	Access was denied for User: '<DOMAIN\Serviceuser>', with AccessID '51949305-5082-4ec6-a8db-e0e34ac0eb6d', SessionID: '4b236f45-2982-43b3-8ab2-a41b0a056bd4', SessionCount: '5', Hostname: '::1', OperationType: 'UsageDenied'	1	2019-03-27 07:53:27
Repository	ERROR	Access was denied for User: '<DOMAIN\Serviceuser>', with AccessID '51949305-5082-4ec6-a8db-e0e34ac0eb6d', SessionID: '763be4ea-f913-468b-b0a7-c785e85a10b9', SessionCount: '5', Hostname: '::1', OperationType: 'UsageDenied'	1	2019-03-27 07:53:26
Repository	ERROR	Access was denied for User: '<DOMAIN\Serviceuser>', with AccessID '51949305-5082-4ec6-a8db-e0e34ac0eb6d', SessionID: 'f9a9b74c-7b73-48fe-91bc-7ed98dadfe72', SessionCount: '5', Hostname: '::1', OperationType: 'UsageDenied'	1	2019-03-27 06:54:43
Repository	ERROR	Access was denied for User: '<DOMAIN\Serviceuser>', with AccessID '51949305-5082-4ec6-a8db-e0e34ac0eb6d', SessionID: '3cd532ad-aa04-4c54-b7eb-52f8de9ec5d3', SessionCount: '5', Hostname: '::1', OperationType: 'UsageDenied'	1	2019-03-27 06:54:41

[Bastien_Laugiero]

Hello, 

This is not a coincidence that you observe this behavior while the monitoring applications are reloading. 

Starting from Qlik Sense April 2018, when reloading the monitoring application, there are several calls against the Qlik Sense Proxy API using the rest connector.
The difference with the behavior prior to Qlik Sense April 2018 is that now, the user doing those API calls (By default the Qlik Sense Service account) is now opening parallel active sessions.
So you are likely to experience this issue if you try to access the Qlik Sense Hub with the Qlik Sense Service account after a reload of the monitoring application. You will get an error saying that you have no access pass for your users.

The recommendation as of Qlik Sense April 2018 is to not allocate an access pass to the Qlik Sense Service account or to create a dedicated user (without a token) and modify the Monitoring Apps Data Connector (monitor_*) to run with this new user (Note, the user running those data connections needs to be RootAdmin).

Additional information available here: https://support.qlik.com/articles/000051633

Hope this helps!

[pwagner]

Hello @ift_isabelle 

what is your solution in this topic?

Thank you.

Best regards, Patrick

[ift_isabelle]

Hi Patrick,

I have absolutely no idea if and how I solved it...

Kind regards,
Isabelle

[Maria_Halley]

@ift_isabelle @pwagner 

Did you check the article that @Bastien_Laugiero attached to this post?

The resolution there is

• Do not allocate a token to the Qlik Sense Service account.
  Or create a dedicated user (no token assigned) and modify the Monitoring Apps Data Connector
• (monitor_*) to use the new user. Note that any user executing those data connections needs to be set up as a RootAdmin.

The article also explains why this happens

[pwagner]

Hello @Maria_Halley 

Yes, I saw his post. It is from 2018 therefore I thought there could be another solution.

One big question, what do you understand as a 'dedicated user'. 

Which rights should this user have?

Thank you. Best regards, Patrick

[Maria_Halley]

@pwagner 

The solution is still the same.

What we mean a dedicated windows user that runs the services, but never logs in to QlikSense.

[pwagner]

@Maria_Halley 
Thank you.

I checked the data connections (monitor_*) and all have the service user as "User ID". And the serviceuser does not have a license.

Do you have another idea what I could check?

Thank you.

[EB]

Hi
Did you manage to make any progress on this subject?
I also see the errors when Operations Monitor runs and similarly the service account does not have a licence assigned and is a Root Admin.
All data connections "monitor_apps_REST_*" show User ID as the service account.
There is additionally a data connection "monitor_apps_qlikview_logs" which shows in Data Connections when viewing script of apps.  This does not have the service account as User ID but the service account does have CRUD user access.
Thanks

[jobo]

Same here.
The Qlik services run under a service account (LDAP user) and this user is RootAdmin in Qlik Sense without a license (he used to have one, but it was removed).
When the ServiceUser still had the license he could not query the Rest API due to SessionCounts >5.
Now that he no longer has a licence he can't because the error message is UsageDenied.