Access denied. server has no user CAL for this account. AD group

[#1]

Hi,

Problem:

User logged in under AD group cannot gain access to the document.

the following error appears: "Access denied. server has no user CAL for this account"

QVS settings:

• Qlikview SBS  11. 11.0.11282.0
• No publisher installed
• Licence: 12 USER CALL allocated / 12 assigned
• NTFS authorization (Windows controls file access)
• Identification : By user name

Scenario:

1. User attempt to login to accessPoint using accouny DOMAIN\Mickeym
2. Mickeym belongs to AD group called DOMAIN\Disney land
3. There is Named CAL assigned to DOMAIN\Disney land
4. Mickeym managed to pass the login page to the accesspoint (authentication succeed)
5. Access to Document A is protected using Section application

here's the code

//Domain ID
LET vNTDOMAINID = 'S-1-5-21-4212263732-3897499842-205464733';
tmpSectionAccess:
CrossTable(Document, Access, 3)
LOAD NTNAME, 
     ACCESS, 
     '$(vNTDOMAINID)' AS NTDOMAINSID,
FROM
[User Access.xlsx]
(ooxml, embedded labels, table is Blad1)
;
Section Access;
NoConcatenate
LOAD
           UPPER(ACCESS) AS ACCESS, 
           UPPER(NTNAME) AS NTNAME,   
         UPPER(NTDOMAINSID) AS NTDOMAINSID
RESIDENT tmpSectionAccess
WHERE Document = '$(vDocument)'; 
Section Application;
DROP TABLE tmpSectionAccess;

User Access.xlsx

NTNAME	ACCESS	A
DOMAIN\admin	ADMIN	x
DOMAIN\Qlikview	ADMIN	x
DOMAIN\Disney land	USER	X

Any Idea's?

Thanks in advance,

Dror

[sreenivas]

Check in server-->licenses-->UserCAL  this username is available or not,If this user is not available in that list remove one of the assigned user in that CAL list

[#3]

Named CAL should be assigned to username account, not group account.

[#4]

Jerson,

Does it mean that i cannot allocate AD group on a Name CAL. I have dozen of users but only 12 CALS.

What's weird is that, user is authenticated, see the all the documents on which his group is authorized .As soon as it try to open the document, he's greeted with the ACCESS DENIED error.

does space in the username account or group account could make a different?

I have a session set to 5 min. Can another from the same group log in, consuming the same User CAL or is there an quarantine time of 24hr?

Dror

[#5]

sreenivas,

The user CAL exist in the User CAL list. however, i don't see any activity logged under (Last used) to the group.

[#6 · Accepted solution]

drorsvr

Although we can assign a Named CAL to a group account on QEMC interface.

I don't think QlikTech will let it work.

If it works, all users belong to that group could just use only one Named CAL.

[#7]

Jerson,

I understand. Is there no way around it? I have 12 named CAL's and 30 hungry users...

Dror

[Bill_Britt]

Buy more licenses or move to session Cals. You can't assign a CAL to a Group and if you could if each time a new user tried to open a document it would kick off the current user.

Bill