Single Sign On on NewsStand

[Natalija]

Hello everyone,

Would like to get advise what to do with my issue.

I have two NPrinting 17 environments running at the same time. One with Feb 2018 and other April 2018 upgrade, and Qlikview.

My goal is to allow users log in inside NewsStand with their domain credentials (preferably without even hitting "Log in" button).

On NP 17 Feb 2018 I tried to sync AD users by following this video: Synchronize Active Directory to Qlik NPrinting - Qlik Tuesday Tips and Tricks - YouTube  I run into issues. First it didn't sync my users with AD group created for NP due some credential error, then I added my username to admin role in NP, and system didn't recognise the AD group.

Tried to add role inside NP (just in case with the same name as AD Nprinting group)

Then, created local group....and it seemed to work

After First success, system would perform incremental load, but wouldn't sync any new users in .

I ended up adding users to NP excel template and import them into NP Webconsole. And faced other issue.

If domain user access NewsStand URL, it would prompt user credentials (when user hits "windows login"), same thing happens if user access NewsStand address (server IP address plus port 4994), BUT!! If user provides server name and port number then NewsStand loges user in without providing credentials just one click Windows Login. Did anyone experienced  same?

In parallel i was testing Feb 2018 NP update, followed this video: Qlik NPrinting LDAP user importer - YouTube and when I get to the step (1:42) provided localhost:3000 I am getting following error message:

Not Found

404

Error: Not Found

at F:\NPLdapInport\app.js:58:13

at Layer.handle [as handle_request] (F:\NPLdapInport\node_modules\express\lib\router\layer.js:95:5)

at trim_prefix (F:\NPLdapInport\node_modules\express\lib\router\index.js:312:13)

at F:\NPLdapInport\node_modules\express\lib\router\index.js:280:7

at Function.process_params (F:\NPLdapInport\node_modules\express\lib\router\index.js:330:12)

at next (F:\NPLdapInport\node_modules\express\lib\router\index.js:271:10)

at SendStream.error (F:\NPLdapInport\node_modules\serve-static\index.js:120:7)

at emitOne (events.js:116:13)

at SendStream.emit (events.js:211:7)

at SendStream.error (F:\NPLdapInport\node_modules\serve-static\node_modules\send\index.js:245:17)

I raised issue with qlik support (01412982), but all i got was the answer: This is third party tools (connectors/extractors) and we don't support that.

Any ideas? Will appreciate any advise, thank you in advance!

Natalija

[Lech_Miszkiewicz]

Hi Natalija,

I am very sorry that you are going through this trouble of syncing AD with NPrinitng.

I was very vocal about API and all "advertisement" Qlik employees were doing around it and integration with 3rd party tools.

I was against promoting an approach were you have to integrate "extensions," or components not produced and supported by Qlik.

If i were you i would completely drop an idea of AD integration using unsupported tools! Instead i would use supported import task, or create your own REST API call with supported API to create and update users.

I would also use April 2018 or soon June 2018 version.

I would do the testing on the freshly installed environment using browsers with cleared cache so there are no user credentials stored.

regards

Lech

[Natalija]

Thanks for reply,Lech,

With Import task, I am facing issues as well, as it prompts users for password again, when they click on "Windows login". I just can't understand why it works properly with server name, but prompts for password if i use user friendly URL or Server IP address to access NewsStand 😕

Natalija

[Lech_Miszkiewicz]

maybe check the webserver logs for details?

[Ruggero_Piccoli · Accepted solution]

Hi,

It is a Windows and browser behavior and I think it is not possible to change it.

It doesn't depend on the import task.

Best Regards,

Ruggero

---------------------------------------------

When applicable please mark the appropriate replies as CORRECT https://community.qlik.com/docs/DOC-14806. This will help community members and Qlik Employees know which discussions have already been addressed and have a possible known solution. Please mark threads as HELPFUL if the provided solution is helpful to the problem, but does not necessarily solve the indicated problem. You can mark multiple threads as HELPFUL if you feel additional info is useful to others.

[Natalija]

Hi,

Had a workaround, added newsstand to trusted sites and upgraded group policy. With default option selected :

Internet Options -> Security -> Custom Level (Internet Zone) ->User Authentication ->'Automatic logon with current user name and password 'seems to work.

But again, my users are from excel import task and not in sync with AD, so again have to maintain users manually. Managed ADFS to work on April 2018 version, but it prompts credentials again, even if i  am loging  from domain.

[Ruggero_Piccoli]

Hi,

In the Excel import file you can spedify the doman and user account. Refer to the page https://help.qlik.com/en-US/nprinting/April2018/Content/DeployingQVNprinting/Import-Users-Filters.ht... and the sample Excel file.

Best Regards,

Ruggero

---------------------------------------------

When applicable please mark the appropriate replies as CORRECT https://community.qlik.com/docs/DOC-14806. This will help community members and Qlik Employees know which discussions have already been addressed and have a possible known solution. Please mark threads as HELPFUL if the provided solution is helpful to the problem, but does not necessarily solve the indicated problem. You can mark multiple threads as HELPFUL if you feel additional info is useful to others.

[Natalija]

Yes, of course you put domain name in excel import template, otherwise windows login button wouldn't work.

[Natalija]

Hi All,

It was Internet Browser issue, when we added Newsstand link as a trusted Intranet site , users were able to log in just by pressing Windows login button without necessity typing in credentials.

[Ruggero_Piccoli]

Thanks for sharing this information. It will be very useful also for other people.

This is the true spirit of a community.

Thanks again