NPrinting and using Active Directory Groups (Azure)

[kdmarkee221]

I have a scenario that I assumed would be fine but is not working as expected.  I have an Active Directory group called POWERUSERS, with 3 people in it:  User 1, User 2, User 3.  That AD group is in the distribution task in QlikView QMC for the app; let's call it ABC.qvw.  My NPrinting publish task for that Qlik app has Users 1 and 2 set up to receive my report.  After publishing ABC, reloading NPrinting metadata, and executing the NPrinting task, NPrinting does not seem to understand that the report recipients are users in the AD group and I get this:

WARN: error during report generation: NPrinting Engine(s) failed to open document: navigator=qlikview;documentpath="qvp://Az-qlikprod/LocalUserPublishedDocuments/ABC.qvw";identity=xxxxxxx\User01. Check connection page for connection status.

When I actually add individual users 1 and 2 to my distribution task in QlikView QMC for the app, then everything works fine.  Does NPrinting work with Active Directory groups, and if so, what setup step(s) am I not aware of?  Thanks.

(Using: Qlik NPrinting May 2022, QlikView May 2022 SR1 - both in Azure)

[Lech_Miszkiewicz · Accepted solution]

NPrinting works with AD groups (but not in the way you think). It can read AD groups from user AD attributes and assign users in NPrinting to such "NPrinting Groups" for task distribution purposes. That means that instead of listing all people individually in the task you can just put NPrinting group. 

NPrinting however is not passing AD Group when for example using section access - it only passes DOMAIN ACCOUNT of the user.

Now you mention few things which are unclear:

• After publishing ABC, reloading NPrinting metadata, and executing the NPrinting task, NPrinting does not seem to understand that the report recipients are users in the AD group and I get this
  • Do you have that group created in NPrinting?
  • Do you see those users added to that group in NPrinting
  • NPrinting uses "Group" to group individual users and uses theirs attributes (not to apply AD Group when using security or similar) but simply to be able to group them in NPrinting or assign role - which links me to the next question.... what do you mean by:
    • When I actually add individual users 1 and 2 to my distribution task in QlikView QMC for the app
      • Do you actually manually add these users in QLIKVIEW QMC authorization section of distribution task?

You error indicates that user you are passing when executing report (I assume via section access) is not recognized on QlikView side of things...

[Lech_Miszkiewicz]

@kdmarkee221 

Have you done test by opening QlikView desktop on NPrinting server and using File-->Open in Server-->alternate identity (and pass credentials of one of users? Maybe you are one of those who belong to POWERUSERS group) - then you would see if you could read ABC.qvw

just curious...

[kdmarkee221]

The QlikView app does not have section access in it.  I do not have nor am I using any Groups in NPrinting for my NPrinting publish task.  If the QlikView publish task ONLY has the the AD group listed in the Distribute tab properties the report WILL NOT be delivered to the users.  If the QlikView publish task ONLY has the the individual user names listed (AD Group is not listed) in the Distribute tab properties then the report WILL be delivered to the users.  

Are you saying that if I used an NPrinting Group called POWERUSERS (with the appropriate users added), and used that in my NPrinting publish task, it would work?  Thanks.

[Lech_Miszkiewicz · Accepted solution]

Hi @kdmarkee221 

no, that is not what i meant. NPrinting does not use AD groups for accessing anything - it uses users. AD Groups are only used to create NPrinting Groups and NPrinting Roles.

Now regarding your issue:

• does NPrinting service account belong to POWERUSERS AD group? Obviously it has to if you want to use NPrinting otherwise NPrinting will not be able to read it, right?

[kdmarkee221]

Thanks for clarifying.  (The nprinting service account/user was added to the QV QMC task, so it's fine due to that.)