QlikView AD Group partial access to assigned group of apps

[dpstanley_13]

We use AD Groups for access to our QlikView apps. I am not a security expert, but in my 5 years as our default admin, I have never encountered this issue. I have 6 apps that use the same AD Group. In the last week, a portion of the members in the AD Group has lost access to 3 of the apps. Not all of the users. I have tried many things to find the issue, including removing one of the problem apps entirely and recreating it with my distribution set to "All Authenticated Users". The user I am using to test still does not have access. Where should I go from here?

[rubenmarin · Accepted solution]

Hi, is the document using section access? Have you tried to post a new app (or the same app) and give read permission to all users? just to discard if it's a windows permission issue

[dpstanley_13]

No section access.  I did actually remove one of the apps entirely from our test server and recreated it using "All Authenticated Users" and the user ID I have been working with still does not have access to this app.

[rubenmarin]

But you see the app in access point and doesn't give access? Maybe it's wotrking with doc cals and you don't have license assigned

If it's not shown on access point I would try to give access to 'All' users (or 'everyone') not just the authenticated ones. Also check access from upper folders, or try to login in the computer with the user to see what folders/files it sees in windows explorer.

[dpstanley_13]

First I want to say that I really appreciate your willingness to try to help me. 

I have tried changing the distribution to just "All Users" and the user ID still does not have access.  I will say that I am using the Users/User Management tool in QMC to see the Documents the user has access to.  I also tried assigning User IDs directly into the app as Named Users.  Two who have access (myself and another developer) and two that lost access.  After refreshing the app, User Management still shows the users that lost access still do not have access.

I don't know a lot about how the licenses work.  Our server states that for Document CALs we have " 0 assigned (0 in license".

[rubenmarin]

I haven't used the User Management tool... but if the user has a User CAL assigned (In QMC -> System -> Licenses -> Client Access Licenses) it should give access to see all documents (Windows permissions or Section Access can limit the documents the user sees).

The other common licese mothed is Document CALs (different of  User CALs) wich gives access to a user to access one single document, but by the meesage you posted seems you doesn't have any Document CAL.

I'm a bit lost here, going step by step, when you say that user don't have access... what's exactly that?:

- User can't open Access Point

- User can open Access Point but doen't sees the app

- User can open Access Point and sees the app but when tries to open it it shows that doesn't have access.

[dpstanley_13]

Sorry for the confusion.  The user is able to get to Access Point and sees the other apps she has access to.  Among the apps she can see are 3 of the apps this specific AD group is assigned to, however, there are 3 apps that the AD group is assigned to that she does not see in Access Point.  She used to see them, but lost them about a week ago.  There are at least 15 more users like her.  The odd thing is that only some of the members of the AD group lost these 3 apps.

I am going to assign her a named CAL and see if that changes anything.

[rubenmarin]

That will be a good test.

And where are this files strored in hard drive? are this apps in the same folders than the apps the user sees or it's another folder/drive?

To confirm that there is no section access that can affect... have you checked also if there is some hidden script? Edit script -> File -> Edit hidden script. If there is no hidden script the option will be greyed out.

[dpstanley_13]

Okay.  So I just found out that there actually was section access added to the 3 apps.  Thank you so much for your effort and patience with me.