Why does the hub deny I have an access pass?

[Anonymous]

I am using Qlik Sense Server 2.0.1.0. I'm on a trial licence.

Until a few days ago I have been able to connect to the hub. I have set up my data load, created a bunch of visualizations, imported users, got the data importing automatically every hour. However, I am suddenly no longer able to connect to the hub and I don't understand why not.

I log in using Windows Authentication (I'm on the server via RDP). I can log into the QMC:

However, when I open the hub in the next tab, I am told I have no access pass:

This is strange, because the QMC says that the Administrator user does have an access pass:

I'm not sure what's gone wrong or how to fix it.

Some things I have tried

• Restarting all the Qlik services.
• Rebooting the server.
• Turning anonymous access off in the central virtual proxy (it was "Allow anonymous user"; I've changed it to "No anonymous user").
• Clearing my cookies.
• Going straight to the hub instead of going to the QMC first. I am prompted to log in, which I can do successfully (as Administrator), but I still get the same error message ("You cannot access Qlik Sense because you have no access pass").
• Logging in remotely from a browser on my PC (external access is set up.) I get the same error.

Some things I have checked

• My trial license has not expired:

(I take that as meaning it will expire on September 15th. Today is September 2nd.)

• There are no other access rules to confuse things:

• The whitelist looks good:

• The right ports are still open in the firewall:

Other strange behaviour that might be related

• If I go to https://win-2cifju7girb/hub/ or https://localhost/hub/, I am prompted to log in and then get a blank white page. The behaviour detailed above is if I use http instead of https.
• If I first log in at https://win-2cifju7girb/qmc/ or https://localhost/qmc/, and then open the corresponding hub URL in another tab, I get this error:

(Clicking the Refresh button presents the same error again.)

This is really strange, because it used to work, but now it doesn't!

I'm really lost. What can I try?

[Anonymous]

No, still waiting here. Qlik's customer service isn't exactly best in class...

[Anonymous]

Yes, I could still log into the QMC.

Where exactly would I find the right log to look for that message? Qlik seems to have dozens of log files...

I can't try changing the proxy session timeout at the moment because my trial license has expired whilst waiting for this issue to be resolved. However, I can say for sure that I couldn't log in even after I'd left Qlik untouched for 24 hours or more, so I'm not sure it is a timeout issue. Would that make sense?

Thanks.

[alextimofeyev]

Magnus,

yes, we see in the logs that the problem starts when the session count reaches 5. I'll try to play with the proxy session duration.

Alex

[Anonymous]

24 hours should definitely be more than enough for any type of timeout to happen, in which case it's not related to the timeout scenario 😕

If I remember correctly the proxy audit security log should contain the type of statements I refer to. Check under c:\program data\qlik\sense\log\proxy\audit\<something>-auditsecurity-proxy.txt

[Anonymous]

Oh, sorry - I forgot to say: We did get it working again briefly by deallocating and reallocating tokens in the User Access Allocations page. After that we found some users would randomly get the "no access pass" message after I published a new version of the app. Deallocating and reallocating their token would fix it, but sometimes we also had to delete and re-add the user.

This didn't really feel like a solution to the root problem and wasn't very satisfactory because:

• Doing that shouldn't make any difference.
• We shouldn't have to do that.
• Sometimes the tokens got quarantined, so we gradually ran out of tokens.

After a couple of days of doing that, the trick stopped working. I'm completely locked out again now.

[Anonymous]

Interesting. Do poke around, but keep in mind that the timeout session is applicable to all users that are logged in and idling. Use my example of 1 minute for debugging only, otherwise you'll have users complaining about being kicked out...

//M

[Anonymous]

Yes, I am seeing "NoAvailableAccessType" in the logs. That's interesting, but I'm not sure it really tallies with my experience. I'll see if I can experiment a bit more when I have access again.

If I understand you correctly, this can be caused by the login function being called too frequently for the same user. Is that right? We have Qlik in an iframe in our website, so I'm not really sure what to do about this. Tell our users not to refresh their browser more than five times an hour? Or reduce the timeout and tell them not to look at the same page for more than five minutes without doing something?

[alextimofeyev]

By the way, I am seeing a lot of "License maintenance unexpected exception. Type: NullReferenceException. Message: Object reference not set to an instance of an object.. Source: Repository.Core" in License logs. Do you know if this could be related to the lockout issue?

[Anonymous]

Your scenario is exhibiting the same symptoms I've seen in situations where I ended up with to many parallel sessions. In my case I'd either done a quick series of logins/logouts or used too many devices in parallel. Although the same symptoms, the root cause for your issue could very well be something else, its impossible to say based on what information is available.

[alextimofeyev]

We have updated the server to 2.0.3, because we suspected that our lockout issue is related to this (fixed in 2.0.3):

Licence Maintenance fails when User Access Type is allocated on user that is deleted

Jira issue ID: QLIK-37736, QLIK-37651

When User Access Type is allocated on a user and this user is deleted, the Licence Maintenance fails to

clean up old sessions.

After the upgrade, I've been able to successfully reinstate one of the users who was locked out prior to upgrade. Will see if the issue reoccurs or not.