QV 10: Document Administrator cannot set mount-folder for distribution?!

[#1]

Hello @all,

We have a QV 10 infrastructure and are trying to set up document admin rights for the different projects, so that the business unit can work with their tasks etc. and do not have access to the server configurations though the QEMC.

But we encountered (among others) one strange problem here: When a document admin sets up a task upon a QVW stored in a publisher folder where he has the document admin rights, he can select a server and mount in the "Distribute" tab. In this selection he only gets the possible values for QlikView Server folders (mounts) where also document admin rights are granted, which is a good thing!

But when the document admin saves this task (with "apply") and runs is, the QVW is published in the standard root folder of the QVS, not the selected mounted folder! When the document admin selects the task in the QEMC, he sees the correct mount folder in the "Distribute" tab, such as he had selected before. But when a server admin goes to QEMC and opens this task, the correct server is selected but the mount folder drop down box is empty!?!!

The only way to fix it now is when a server admin opens the task, go to the "Distribution" tab and select the currect mount folder. But thats really not the way it sould work. For us it is neccessary that a document admin can do his work without the need to grant server admin rights!

Any ideas?

Environment:

QVS, QVD on one server QV10 SR4,  QEMC on another server QV10 SR4, webserver with IIS centralized.

[Anonymous]

We're having the same issue.  I think that this is a bug that should be submitted through the customer portal.  Please let me know if you hear of a fix for this in the mean time.

[Miguel_Angel_Baeyens]

Hi Dominik,

Does the document administrator user have permissions on both the source folder and the distribution folder granted in the QEMC as well as in the filesystem? Are your tasks using some section access or being distributed using the security field (i.e: loop and reduce based on DOMAIN\USERNAME kind of field? And does the user appear in the document admin group when you search for him or her in the Users tab of the QEMC?

Hope that helps.

Miguel

[#4]

Hi Miguel,

here the answers to your questions:

the document administrator has permissions in the QEMC on both source folder (publisher) as well distribution folder (server). But access on these folders in file system he has only in rare cases and I don't want him to generally have access to all these folders. This would mean that I had to care about settings in QEMC as well as the Windows ACL lists. Why should the document administrators need direct access to the folders? I thought the QlikView Service User is performing the tasks?

The bug occurrs on documents with and without section access, and all the document admins appear as document admins ini the Users tab (after having learnt that QlikView is not able to deal with AD groups for document admins and we have to insert every singe AD user here... incredible 😕 )

One more strange behavior: In environments with more than one server, the first server (I think in alphabetical order) is selected in the server drop down box (taskdefinition, distribute tab). When i change the server lets say to server 2 in the server drop down box, the mount drop down box is not updated and still shows the mounts on server 1.

Currently it is not possible for us to set up a document administrator concept in an enterprise scale.

[Miguel_Angel_Baeyens]

Hi Dominik,

Those users in the QEMC should be in the local group QlikView Document Administrators. Check this video that explains how the Document Administrators work.

Hope that helps.

Miguel

[#6]

Hi Miguel,

which "location" do you mean by local group? The server running the management console? The server running the publisher? The QlikView Server? Webserver? All of them?! We have dedicated servers for all components. An enterprise consultant of QlikView Austria told us, that local groups aren't neccessary anymore with QV 10 SR 4. And I can't imagine that it should be neccessary to do so (and to keep all of them up to date!), and that it was intentionally specified this way.

[Miguel_Angel_Baeyens]

Hi,

I'm not aware of that local groups are no longer required in QlikView SR4, so first notice here [1]. I keep anyway using local groups for QlikView Administrators and QlikView EDX (the former is created in the setup process, the latter is not, so I have to create it manually) in the computer where the server process and distribution service are running and they are working fine so far.

I'm not going to contradict that QlikView consultant, because he works for the vendor. So I'm afraid I have been useless on your issue.

Regards and sorry.

Miguel

[1] Pasted from the latest release notes document of QlikView 10 SR4 Update by the way (the upgrade process of version 11 still shows that some users are required to be added to the local Administrator group). If this is not correct, please let me know so I can contact QlikView support and ask them to rewrite this part.

The QlikView Server services are designed to run as local administrator. Running with an account that is not local administrator is an unsupported scenario.

[#8]

Hi Miguel,

sorry, if I was misunderstandable on that topic: local groups are still required in the manner you are pointing it out. Yes, the QlikView service user has to be local administrator, and the local group "QlikView Administrators" is still neccessary.

What I am talking about is just the document administrators, where a local group should no longer be neccessary, as all settings can be done via QEMC.But the document administrator concept doesn't seem to be mature in QlikView so far...

And thanks for your contribution here, I am really appreciating it!

[Miguel_Angel_Baeyens]

Hi Dominik,

All clear now, thanks.

I'd try if you have not done already, if not using the local groups for QlikView Document Administrators in the server where the distribution folders are (so they can read documents) and the server where the distribution service is, at least assigning them NTFS permissions there because they will need NTFS permissions on the xml files that store the tasks. These are files, at the end of the day, so if I don't have permissions on the folder where I'm going to store the xml file for the Task 1, probably the QEMC will let me check and select, but will eventually not store them.

Hope that helps.

Miguel

[Anonymous]

Hi Miguel and Dominik,

Miguel - I tried what you suggested by creating the "QlikView Document Administrators" security group and making sure that the group as NTFS permissions over the proper directories, but it is still not working.

I don't think that this is a permissions issue in any way.  Prior to creating the security group, our users were able to create, edit and run tasks through QEMC.  In order to do that, QDS has to create a task xml file in the application data.  All settings work as expected with the exception of distributing to a User Document mount.

I have submitted a support case with QlikView on this very issue, as I expect this to be a bug.  I will let you know what I find out from QV support.

Thanks,

Jeff