Section Access with Cross Domain Connections (Multiple LDAP)

[matt_crowther]

Blast from the past question here regarding Qlikview Server 11.2.

A client has 2 separate domains with trust between the 2. The Qlikview server is hosted in Domain A and all Domain A users can access the server as expected. The client now needs users from Domain B to be able to access the Qlikview Server on Domain A.

We've been able to get the Qlikview Server (on Domain A) to see Domain B's LDAP and users can connect to the Access Point and see and access all documents WITHOUT Section Access however as soon as Section Access is included in a document they can't see it - of course their usernames (DOMAIN_B\myuser) have been added into the Section Access model.

Does anyone have experience of this situation as this can't be the first time a multi-domain requirement has come up? Any guidance would be great!

All the best,

Matt

[Brett_Bleess]

@matt_crowther That should work provided the NTNAME values in the Section Access table have the Domain\User setup.  You should not need the NTDOMAINSID unless you can potentially have duplicate users, but I do not think this should happen in this case.  You did not say what version of 11.20 either, if it is an older SR, it may be something defect related that was addressed in a later SR too, so keep that in mind as well.  If the Domain B users can login to the AccessPoint and it shows their user ID correct in the AccessPoint page the same way the Domain A users are being shown, I would suspect everything should be good, but if there is a delta, you may need to do a regular app and use the OSUser() function in it to see how Domain A v Domain B users are being logged with that, that is about the best way to get to the bottom of things I think, as there has to be a mismatch I think somewhere.

Regards,
Brett

[matt_crowther]

Brett,

Many thanks for the suggestions. We've already tried them all and sadly nothing pointed to a solution.

We have had progress in that the users that have migrated from Domain_A to Domain_B can still access as before with their new accounts however pure new (Domain_B only) accounts can not?? - of course the SA data files are rebuilt accordingly for the new users.

Thanks again,

Matt