QlikView dashboard session issue

[willman0982]

We encountered a weird thing for our landing page dashboard recently. Details as below:

1. We build a landing-page.qvw to show all links of dashboards which a user can access. And it will show the usesrs' full name in dashboard.

2. On top of landing-page.qvw, we built  a html file with iFrame, and embedded langing-page.qvw in this html file. The html file is hosted in IIS.

3. Our business users usually open the html with "http://landing-page.com" to open the langing-page.qvw to navigate him to any dashboard he has access.

4. Last week, we encountered a weird thing, some users reported that when they open the langing page, they saw other user's name instead his name. And we checked the session logs and found that it indeed logged another user's name. After some user clear the browser cookies, it was working for them again, and we cannot reproduce it in our machine. Does anyone have any idea for this? Thanks.

Errors from Event Log:

Session stop reason: invalid iis authentication string

System: SERVER - DMR: Validate and Apply Hex. UsrName(true)

Server: ValidateAndApplyHex40: Error: 'true' is not hex

[Bill_Britt]

Hi,

Take a look at this article and see if it helps.

https://support.qlik.com/articles/000005620

Bill

[willman0982]

Bill, appreciate for your reply.

Based on the link https://support.qlik.com/articles/000005620 your provided, it may have common causes for such error.

• User’s name is invalid
• User’s ticket is invalid 
• User’s remote IP does not match
• User issue related to NT/AD group security policy

From what i noted in QlikView logs, it may caused by "User's ticket is invalid".

1. We are sure that there is no issue for IIS configuration. IIS is only used for host landing page html, from IIS log, we noted that the authenticated user name and client IP address are all correct for all visitors.

2. The user id captured in QlikViewn WebServer logs is also correct, the user id sent to QlikView WebServer for authentication, but the GetTicket function return wrong ticket which is created for another user. We used OSUser() to get login user id, but OSUser() returned wrong user id.

3. We noted that this issue is related user cookies. When user cleaned up cookies from browser, this issue was fixed for him, but when the next user access dashboard, he saw the user id of the one who cleaned up cookies. I am not sure how GetWebTicket works, how does it return ticket ID for a given user id, but i guess it will check user cookies in request, including qlikmachineid and AccessPointSession. I guess there might be a global collection in QlikView WebServer to store user cookies and related ticket ID in server side, and GetWebTicket will check existing cookie to find out existing ticket ID for this user first, if the cookie does not exist, it will create a new ticket ID for this user. Could you please help confirm the logic? if this is correct, i guess there might be some error/exception which leads to issue to get correct ticket ID for a given user id.

We also noted that someone else encounter the similar issues.

Solved: Re: problem with qlikview 11 and some authentifica... - Qlik Community - 1540938

4. The biggest problem is that we don't know what triggers the issue, and therefore, we cannot reproduce such issues. Could you please shed some light on this? 

[Bill_Britt]

Hi,

Look in the QVS event log and see if more than one ticket is issued around the same time. They check your SSO solution and see it the ticket is being applied to the correct user. 

Bill

[willman0982]

Bill, thanks for your reply. We use default windows authentication, have not integrated with SSO or customized authentication. I did note that more than one ticket is issued around the same time in QVS event log. But how can the GetWebTicket return wrong ticket belong to another user for a given user id?Our analysis get stuck here. Appreciate if you can help shed some light on this. 

[marcus_sommer]

Is there a special reason why the native access point isn't used?

- Marcus

[willman0982]

Marcus,

Native access point can only display qvws in 1 server, we need the landing page to show all qvws available for login user across multiple servers, moreover, we also need to customize the dashboard group, display order, etc. And per our observation, it seems not related to landing page or native access point, even we open the qvw link directly, we will encounter the same issue. Thanks.

[marcus_sommer]

Is it a rather new solution which may had never really worked like expected and now after the rollout the issue occur or is it an old approach for which you could be very sure that it worked like intended and since n days the behaviour did change?

In the last case it would be helpful to look if anything has changed on the Qlik/OS/network-side?

Beside this a single access point for multiple servers is in general possible and there are also ways for customizing the access point. Surely not for each scenario but maybe it might be possible with lesser efforts as your approach:

1 AccessPoint for 2 different QVS. Is it possible? - Qlik Community - 427144

- Marcus

[willman0982]

Marcus,

Appreciate for your reply.

1. This is not a new solution, we built this several years ago, and it works fine, we just noted such issues recently after we upgraded to QlikView Server 12.5 from 11.20. There is no change on OS/network side.

2. "1 AccessPoint for 2 different QVS" is not working for our requirements. As we stored all QVWs information (server, url, category, display order, display name, description, entitlement...) in our database, and load the available qvws links in our "landing page" dynamically based on logon user's permission. So we built our own solution instead of using "1 AccessPoint for 2 different QVS" which we don't have enough control.

[marcus_sommer]

Multiple settings in 12.5 are new and/or different (in regard to the set defaults) as in 11.2. I don't know which one may related to this issue. If the previous settings are further available I would compare them against the new settings. This means to look into the settings.ini from the server and the xml-config-files from directory service and the web-server for settings which may have a relation to sessions, credentials and timeouts. Maybe there occur some interesting hints to what may be worth to try out - meant is just a few trials and not a complete trial & error approach for all possible configurations.

Maybe it's something similar to the user settings from the desktop client in tab general (top left area) where you could enable/disable if the login-credentials are stored until the session ends ...

- Marcus