NPrinting Section Access -Qliksense

[puratchid3]

I am using NPrinting April 2019 version.

While using section access with Qliksense i face error retrieving data.

Only the user with Root Admin roles in QlikSense is retrieving the data for others it return error.

The users already have professional and Analyser license in QlikSense same user is available in NPrinting also.

But the user only with Root Admin is getting the report.

[rafalcqlik]

Hi @puratchid3,

were You able to make it work? I'm having exactly the same problem. I'm the developer (I am not the root admin) so I have access to all streams and applications. I have access from QS to the application I want to create NPrinting reports from. My access is defined as ADMIN in Section Access and I'm using DOMAIN\USERID there. Section Access is definitely working fine (no issues when opening app from Hub). NPrinting connection is defined correctly (it uses domain account - the same is used to run NPrinting services and QS server, root admin in QS). Connection work fine for any other application without section access. That user also is defined in Section Access with admin privilege (without that I couldn't generate cache). My NPrinting user has correct DOMAIN/USERID provided in "Domain account" field in NPrinting. I'm using November 2018 version of NPrinting.

Now when I want to generate preview, I'm getting "NPrinting Engine failed to open document". When I run a task where I have 2 recipients defined (myself + user with root admin in QS) I'm getting the same error for my user but everything is fine for the other user that has root admin privileges. 

Any ideas?

Here is task log:

May 13, 2020 3:42:41 PM	Info	Starting content resolution for report abcc8f2f-726f-41e4-88e7-829b3df47267
May 13, 2020 3:42:41 PM	Info	Starting content resolution for report abcc8f2f-726f-41e4-88e7-829b3df47267
May 13, 2020 3:42:55 PM	Info	Finished content resolution for report abcc8f2f-726f-41e4-88e7-829b3df47267
May 13, 2020 3:42:55 PM	Info	Starting content production
May 13, 2020 3:42:55 PM	Warn	WARN: error during report generation: NPrinting Engine failed to open document
May 13, 2020 3:42:55 PM	Info	Finished content production
May 13, 2020 3:42:55 PM	Warn	Failed generation of report abcc8f2f-726f-41e4-88e7-829b3df47267 for user 0cb41344-2dfa-402a-861d-5acc71289abc. ERROR: NPrinting Engine failed to open document
May 13, 2020 3:42:57 PM	Info	Finished content resolution for report abcc8f2f-726f-41e4-88e7-829b3df47267
May 13, 2020 3:42:57 PM	Info	Starting content production
May 13, 2020 3:42:57 PM	Info	Finished content production
May 13, 2020 3:42:57 PM	Info	Starting publishing for task bd278a13-e06f-4024-be2a-179942e64f13 report abcc8f2f-726f-41e4-88e7-829b3df47267 user 68b590d0-633e-461a-9625-8aed0443e54a file XXXXXXXXXXXXXX
May 13, 2020 3:42:57 PM	Info	Finished publishing for task bd278a13-e06f-4024-be2a-179942e64f13 report abcc8f2f-726f-41e4-88e7-829b3df47267 user 68b590d0-633e-461a-9625-8aed0443e54a file XXXXXXXXXXXXXXXXX
May 13, 2020 3:42:57 PM	Info	Plan branch execution completed

[Lech_Miszkiewicz]

Hi @rafalcqlik 

Does NPrinting service account have access to stream where your application is in Hub. Just checking as Root Admin  role applies only to QMC and stream access you could have setup using some custom rules which exclude NPrinting service account.

[rafalcqlik]

Hi @Lech_Miszkiewicz ,

Yes, service account has access to all streams and also has license assigned.

[Lech_Miszkiewicz]

License is not required as per documentation.

And to be honest there is nothing else I can add to it. I am assuming that you made NPrinting service account part of section access with ADMIN privileges and made sure it also has relationship to all data (if you use SA for data reduction).

I cannot think of anything else.

cheers

Lech

[Ruggero_Piccoli]

Hi,

Based on the error log I think the issue is with the user that runs the Qlik NPrinting Engine service. As suggested by Lech please check that it mets all the requirements listed in the help site. 

Best Regards,

Ruggero

[rafalcqlik]

I cannot find anything that we are missing in configuration. I found something like that:

April 2019 NPrinting and earlier versions: In the QS QMC, assign a QS 'Analyzer' license/token to the domain user account used as the NPrinting Connection Identity

We are using November 2018 and we do not have Analyzer licenses (only professionals) and that is assigned to service account. Besides, reports are being successfully generated for every QMC admin user.

We will try upgrading to February 2020.

Thanks for help, I will post the results.  

[Ruggero_Piccoli]

Hi,

If you plan to upgrade, I would like to suggest you to upgrade to latest version that is April 2020.

Best Regards,

Ruggero

[gdelaossat1]

Can you test including the service account in section access rules as admin if you are using section access in los script. This could be concatenating an in-line.

Section Access; LOAD * inline [ ACCESS, USERID ADMIN, XxXxXxXxX ];

[rafalcqlik]

I have that already added. Without giving access to service account in section access, NPrinting wouldn't even generate the cache so I had to do that first.

We've also enabled the debug logging and here is what we found in the log for user which get the "NPrinting engline couldn't open document" (removed sensitive data, reminder: that user is a developer in QS with confirmed access to the app) :

Spoiler

Qlik.NPrinting.Engine 18.39.6.0 Qlik.NPrinting.Engine.Consumer.ConnectionResolvers 20200514T043919.017-04:00 WARN <server name> 0 0 0 0 0 0 0 0 Failed to open a resolver for connection navigator=qliksense;proxyurl=https://<QLIKSENSE URL>/winauth;appid=bf4bf207-5162-4f5a-a48f-801e35f998df;identity=<DOMAIN>\<USERID>. ERROR: System.Exception: No valid Sense Certificate found or Unauthorized user in Header 'X-Qlik-User'=UserDirectory=<DOMAIN>;UserId=<USERID>. ERROR: System.Net.WebException: The remote server returned an error: (403) Forbidden.↓↓ at System.Net.HttpWebRequest.GetResponse()↓↓ at Engine.Navigator.QlikSense.SDK.QRSApi.TryGetResponse(HttpWebRequest request)↓↓ at Engine.Navigator.QlikSense.SDK.QRSApi.DoGet(QlikSenseConnectionString connectionString, String port, String urlChunk, Boolean addQlikCertificate, Boolean impersonateService)↓↓↓↓Server stack trace: ↓↓ at Engine.Navigator.QlikSense.SDK.QRSApi.DoGet(QlikSenseConnectionString connectionString, String port, String urlChunk, Boolean addQlikCertificate, Boolean impersonateService)↓↓ at Engine.Navigator.QlikSense.SDK.QRSApi.GetProxyID(QlikSenseConnectionString connectionString)↓↓ at Engine.Navigator.QlikSense.SDK.QRSApi.GetValidEngines(QlikSenseConnectionString connectionString)↓↓ at Engine.Navigator.QlikSense.SDK.SenseApp.SelectEngine(QlikSenseConnectionString connectionString)↓↓ at Engine.Navigator.QlikSense.SDK.SenseApp..ctor(QlikSenseConnectionString connectionString, Int32 renderRequestOverallTimeoutMSec)↓↓ at Engine.Navigator.QlikSense.SDK.SenseNavigator..ctor(QlikSenseConnectionString connectionString, RenderingManager renderingManager)↓↓ at Engine.Navigator.QlikSense.SDK.SenseNavigatorFactory.GetSenseNavigator(QlikSenseConnectionString connectionString)↓↓ at Engine.Navigator.QlikSense.QlikSenseContentNavigator.<>c__DisplayClass2_0.<.ctor>b__0(ISenseNavigatorFactory nf)↓↓ at System.Linq.Enumerable.WhereSelectArrayIterator`2.MoveNext()↓↓ at System.Linq.Enumerable.FirstOrDefault[TSource](IEnumerable`1 source, Func`2 predicate)↓↓ at Engine.Navigator.QlikSense.QlikSenseContentNavigator..ctor(QlikSenseConnectionString connectionString, IEnumerable`1 navigatorFactories)↓↓ at lambda_method(Closure , Object[] )↓↓ at Autofac.Core.Activators.Reflection.ConstructorParameterBinding.Instantiate()↓↓↓↓Exception rethrown at [0]: ↓↓ at System.ExceptionExtensions.RethrowInnerException(Exception this, Boolean ifInnerExceptionIsNullRethrowThis) in C:\Jws\release-18.39.x-w104zyghT\server\NPrinting\src\Qlik\Qlik.Reporting.Common\System\ExceptionExtensions.cs:line 264↓↓ at Qlik.NPrinting.Engine.Consumer.ContentResolverFactory.Get(Guid engineId, String connectionString, IRequestBuffer buffer, Int32 initialMaxBatchSize, CancellationToken cancToken, Int32 resolverSessionTimeoutSec) in C:\Jws\release-18.39.x-w104zyghT\server\NPrinting\src\Engine\Consumer\ContentResolverFactory.cs:line 34↓↓ at Qlik.NPrinting.Engine.Consumer.ConnectionResolvers.TryOpenResolver(Int32 initialMaxBatchSize, CancellationToken cancToken) in C:\Jws\release-18.39.x-w104zyghT\server\NPrinting\src\Engine\Consumer\ConnectionResolvers.cs:line 311

As for upgrading to April 2020 - we like to be 1 version behind in case of any issues 🙂

[Ruggero_Piccoli]

Hi,

" No valid Sense Certificate found or Unauthorized user in Header" so be sure that the Qlik Sense certificates are correct and installed as explained in: 

https://help.qlik.com/en-US/nprinting/April2020/Content/NPrinting/DeployingQVNprinting/NPrinting-wit...

and check that the user who runs the Qlik NPrinting Engine services has the correct rights on the Qlik Sense server (RootAdmin).

Best Regards,

Ruggero