SharePoint Web Parts Kerberos Authentication Issue

[jdf]

Hello,

I am working with a sharepoint farm server setup and using sharepoint web parts to display QlikView.  We are using kerberos for authentication and the sharepoint credentials for security.  However when a user logs out and a new one logs in, the QlikView server doesn't recognize the change in the user.  Does anyone have any insight as to what is ocurring?  Any troubleshooting ideas?

Thanks,

~jake~

[garystrader]

A couple of questions:

1) Are you sure that kerberos is being used between the servers?

2) What do you mean by "when a user logs out and a new one logs in"?  Each user should be logging in from their own workstation, right?

[jdf]

Yes I can see in the IIS security logs that kerberos is being used.

No sometimes multiple users can use the main station.  The login doesn't change as the sharepoint users change it stays whatever the first user is.

[Lee_Matthews]

Hi Jacob

Sharepoint just passes the current user's credentials to QlikView when it accesses content from the QlikView server. But I dont know if it sends the credentials of the account logged onto Sharepoint, or the account as logged onto the workstation. Based on what you are seeing it is possibly the latter. I assume your user's are just changing the sharepoint login, not the actual windows login. Have you tried getting them to log off windows and then log in as a different account?

[jafari_ervin]

Hi Lee

I Tested before sharepoint send the account as logged into the workstation.

[jafari_ervin]

Dear Lee

I have another problem too, when we open the SharePoint site from SharePoint server SharePoint send the logged in account to the qlikview but when we open the SharePoint site from another workstation, SharePoint didn't send any user and qlikview recognized anonymous user!!

What’s your suggestion?

Best Wishes,

[Lee_Matthews]

I assume you have Sharepoint on a different machine to QV Server. If so this issue is the classic 'double hop' problem, whereby Windows authentication is designed to authenticate a client to a server, but that server cannot typically pass on the user identity to a second server. It is usually resolved with windows kerberos ticketing, which is notoriously difficult to configure (ie. a windows issue, not QlikView). Are you using QlikView web parts? I believe there is an installation option with QV Web Parts that allows you install a proxy that resolves this issue.

[jafari_ervin]

Hi lee

Yes I used from qlikview web part and in installation wizard I select the proxy setting but this issue not solved yet.

Thanks