Using NTLM for authentication, LDAP for distribution

[Brian_at_JPMC]

Hello community.  I am trying to resolve the following issue.  We would like to use NTLM for authentication (using IIS/QVWS).  This is fine, as long as we are limiting our distribution to Active Directory groups.  We find however, that we cannot use LDAP groups for distribution.  The issue appears to be that with NTLM, QV is presented with an ID in the form of ADDomain\USER_ID.  This value does not retrieve LDAP groups for the given SID.  Is there some way to use LDAP groups for distribution, when user is logging in via NTLM?  Thank you for your assistance.

[Albert_Candelario]

Hi,
When you are creating a task are you able to fin the LDAP groups to add them as named users on the task?
Did you also check https://community.qlik.com/t5/QlikView-App-Development/LDAP-group-name-and-users/td-p/1203376 ?
Kind regards!

[Brian_at_JPMC]

Yes, on the task, I am able to query for and add the LDAP group to the named users list for distribution.  The problem seems limited to how the QVWS attempts to retrieve groups for the NTLM credentials.   Even though the user, logging in via NTLM, is a member of that group, they are not seeing the dashboards.

[Albert_Candelario]

Is this happening for all apps? Do you have section access on them?

And are you using DMS or NTFS?

Kind regards!

[Brian_at_JPMC]

This is setting up a new server.  Section access is not involved, at least not yet.  This is simply trying to get one dashboard to show when distributed to an LDAP group.  We use LDAP successfully for distribution in another environment where we use SSO instead of NTLM for authentication.  In both cases, we are using DMS.

[Albert_Candelario]

Yes, to pass the credential you would need to use SSO or another solution. There is some documentation on this:
https://support.qlik.com/articles/000005648
https://support.qlik.com/articles/000003124
https://support.qlik.com/articles/000005586
Please have a look and also compare to your working environment.
Cheers!

[Brian_at_JPMC]

I do not think it is an issue of passing credentials.  I can get it to work when using an individual ID, if I set the prefix in the LDAP configuration to match the domain of the logged in user.  The issue is when I want to use an LDAP group.  The groups does not seem to be returned, or is returned in an unusable format.   I am comparing to our current environment, which does use SSO and LDAP successfully.  One difference I have found is that in the QVWS log, when sending the id and group list, the new environment has this set:

<GroupListIsNames>false</GroupListIsNames></Global>

whereas the old current environment has

<GroupListIsNames>true</GroupListIsNames></Global>

I am wondering if the group values returned when this is set to false is incompatible.  I cannot find out how to set this to true to test.  Do you happen to know how to set this to true?

[Brian_at_JPMC]

Thanks again, Albert.  That first link states, in part, this:

•If using NTLM for authentication, the group membership information is taken from the Windows authentication.

Since Windows has already told Accesspoint the username and also about the group membership for the user, the Directory Service Connector will not be asked to resolve groups. So Accesspoint will show the documents based on the group membership from Windows Authentication, not the group membership in the Directory Service Connector.
If this is not the desired outcome, then NTLM is not a suitable authentication mechanism, and it would make sense to switch to another authentication method that either identifies the groups correctly or not at all.

This may be the fundamental issue.  Is there really no way then to use NTLM for authentication, but still use LDAP for distribution?  Has no one done this?

[Brett_Bleess]

Brian, have you tried using the Alternate Web Page (Webform) option in the QVWS settings?  Only thing of which I can think that might cause things to behave differently... This will force the users to login separately from having their web browser process things automatically, just FYI.  It is the only method of which I can think that will get the DSC involved in order to check the LDAP groups as well...

Regards,
Brett