Users can only see apps with "All Authenticated Users" distribution setting

[dpstanley_13]

I have 4 users, all at the same hospital campus, that can only see the apps in Access Point that use a distribution method of "All Authenticated Users".  We use AD Groups and they are all in the AD Group for our HR Dashboard, which limited access via the "Named Users" setting.  QMC shows the users have access to the HR Dashboard, but the users cannot see it.  I have even added them directly under Named Users and it changed nothing.  I have combed the app for any section access setting and find none.  I am completely stumped at this point and any assistance would be greatly appreciated.

[Sonja_Bauernfeind]

Hello!

This sounds like the users have been assigned CALs, but not file access permissions. To open a document, the user needs both.  

Assuming that you are using the out of the box method, meaning Windows handles all file access (NTFS) for QlikView, the authentication to authorization to eventual "I am allowed to see this document" in QlikView works like this:

1. Successfully Authenticated by Windows (Web Browser + Windows Client credentials) Yes, I am allowed into the system. 
2. Does the authenticated user have access to the QlikView document? (NTFS Rights) Yes, I am allowed to access this document.
3. Does the QlikView document have Section Access in the load script, and if so, is the User allowed to open it? Yes, I am allowed to access this document, the sequel. 
4. Does the User have a Named/Document CAL assigned or is a Session or Usage CAL available? Yes, I have a LICENSE to use the product. 

What I believe is happening in your case is that step 1 works fine and they have a license (Named CAL in your case), but you did not give the users permissions to access the actual file. Which is why if you set the document permissions to be set to All Authenticated Users, those users are allowed to open it since, well, all authenticated users now have access on Windows File level.

(The same applies if you are using DMS mode - except all the permissions are handled in QlikView)

What you need to do is to add that AD Group to have File Access to the HR Dashboard. 

Here are some related articles to this:

• Users cannot see documents on AccessPoint (kb 000079673) 
• Example: How DMS authorization works (000022745) 
• Authorization (Help.com)

/Sonja 

[Brett_Bleess]

One other key point here, it appears you are using Publisher to distribute the files, I am curious if the DistributionReport.xml generated on the distribution and written to the QDS log folder contains the correct groups/users there or not?  My other hunch would be there may be an issue with the DSC Active Directory DSP configuration such that we are not able to get lookups of the groups or individuals in your case given you said users did not work either, but the QDS has to have the DSC be able to do the lookups for it, so that would be the other place to check things, is your DSC setup to be sure things are working there and there are no errors on the LDAP connection paths...

Regards,
Brett