IE plugin: security settings denies access

[#1]

I've been throwing way too many hours into this already, so I'm putting it out here in the hope that someone else has come upon the same problem. My goal is to get a single qlikview application (1 QVW file) working with both the Ajax interface and the IE Plugin, using the ticket system available in qlikview. This is also known as single sign-on.

The Ajax interface works fine, I request a ticket and redirect to the url of the Ajax interface with ?userid=<ticket> added to it. The IE Plugin does not work no matter what I try. I've tried both with and without section access, using the qlikx webpage, using the qvp:// link and I've tried connecting from a remote client and local client (the server that runs qlikview). So far I've not been able to connect at all.

As a test I've created a new (very simple) qlikview application without any data or section access in it. There's just a single text element on it that says "test". I'm requesting tickets for user "qlikview", so I've added that user to the DMS. I've even added anonymous (didn't help though and the file should not be publicly accessible). Instead of using ?userid=<ticket> I believe I should be using ?iis_authenticate=<ticket>, but this doesn't seem to do anything.

What's the next step?

[vgutkovsky]

I think it would help if you open a sample file from the AP and take a look at the source code between the <iframe> </iframe> tags--you'll see the proper syntax for passing a syntax to the IE Plugin.

[#3]

Thanks for the reply. Unfortunately the only online samples I could find (I've removed the samples that come with qlikview since we don't want them on our live environment) dont actually use iis_authenticate. Here's a sample url:

qvp://ec2-174-129-80-59.compute-1.amazonaws.com/- NEW - FantasyFootballDraft.qvw?iis_authenticate=&t...

Besides the fact that it doesn't use iis_authenticate, it doesn't work for me. Does that link work for anyone else? How about this one:

http://demo.qlik.com/QvAJAXZfc/AccessPoint.aspx?open=&id=Demo|-%20NEW%20-%20FantasyFootballDraft.qvw... (same link, it opens the previous link in an iframe)

[vgutkovsky]

Sander,

Both links work for me. It's possible that your IE security settings are set too high. As a test, try reducing the settings to minimum and see if that solves the problem.

Regards,

[#5]

Thanks for the tip, I've just tried it, but no luck. Do you know what version of the IE plugin you are using? I've tried both build 6299 and 6326, neither worked for me.

[vgutkovsky]

I've tested this successfully with both 7320 (9.0 SR2) and 6326 (8.5 SR6). You're using IE 32-bit, right? Neither your domain policy nor IE security prohibits ActiveX? Specifically, make sure you enable "Initialize and script ActiveX control not marked as safe." Check to make sure your authentication settings are consistent between QMC and IIS (i.e. that if anonymous is prohibited on one, it's also prohibited on the other). Finally, try giving the IIS_WPG user read permissions on any relevant application and document folders.

[#7]

Thanks again for the reply. The setting you mentioned was disabled for me, I've enabled it. No luck though, it still doesn't work.

My system specs:

Windows XP SP3 + latest updates
IE 8.0.6001.18702
QlikView IE Plugin 8.5.6326

The URL points to the official Qlikview demo site, which I obviously cannot control. If the URL works for you then IIS/Qlikview Server appear to be configured correctly and I should be able to use the same URL. I assume this is a client side problem, not a server side one.

I've just installed the IE Plugin in a virtual machine (Windows Vista, IE 7.0.6000.16609). The same thing happens: it loads for about 20 seconds, after which I get the following login screen:

At this point it doesn't matter what button I click, I always get the following message:

Failed to reach server: ec2-174-129-80-59.compute-1.amazonaws.com:-1
Switching to HTTP tunneling
Connected to server OK, Negotiations Timed Out

Followed by:

Failed to open document.

I've found another thread where you also replied: http://community.qlik.com/forums/p/17472/92614.aspx
But in that post you're talking about reinstalling the Server software, which apparently works fine because you can connect to it.

[vgutkovsky · Accepted solution]

If you've installed the toolbar on a clean Windows installation and are getting the same error, it sounds like a firewall issue to me. Check to make sure you have the proper ports (usually just 4747) open. If the virtual machine is on the same physical box as the machine you were trying it on before, it might also be a software firewall or NIC problem. Also run some stress tests on your port to see how lossy your communications are.

[#9]

Thanks! I disabled the firewall on my local system ages ago and never thought there would be a firewall blocking my outbound connections in the company. I've just had port 4747 removed from the blocklist and now the demo links work fine for me.

Obviously the application I'm working on for my company is still broken, but at least now I'm getting a different error message and I'm getting it much quicker: "Failed to open document, You don't have access to this document.".

[vgutkovsky]

Glad that got rid of one problem at least 🙂 For the new error, check your file permissions obviously. Also make sure anonymous authentication is consistent between QEMC and IIS. If QEMC is set to Allow Anonymous, you should make sure that IIS has Anonymous Authentication and Windows Authentication enabled for all virtual directories. Otherwise, if QEMC is set to Prohibit Anonymous, IIS authentication should just be set to Windows Authentication.