Knowledge

[Frank_S]

With Microsoft IIS deployed as the webserver, NPrinting On-Demand fails with: 

An error occurred: {"code":403,"message":"User has no rights to access the resource"

Environment:

• Qlik NPrinting 
• Microsoft IIS 

Resolution:

1. Check that you have fully configured all the prerequisites accurately from the installation and configuration requirements as documented on the Qlik Online Help > On-Demand reports > Creating On-Demand reports requirements.
2. Review the steps for creating and using a self-signed certificate covered under How to configure NPrinting On-Demand with JWT Authentication for QlikView that uses IIS
3. If any of the configuration/requirements steps are missed, this too can cause the issue:
4. How to configure on demand: Help > On-Demand reports > Enabling On-Demand reports 
5. If using a third party pfx / p12 certificate, the following command can be used to obtain the .crt file where server.pfx is the issued PKCS12 certificate, and server_forJWT.crt is the PEM formatted certificate containing the text that is pasted in the JWT Certificate field in the NPrinting Web Console JWT Authentication settings. (.pfx / .cer nees to be on current directory, and .crt will be created and placed in current directory)
   
   openssl pkcs12 -in server.pfx -clcerts -nokeys -out server_forJWT.crt
   
   If the certificate is in x.509 format use the following:
   
   openssl x509 -inform DER -in server_noPrivateKey.cer -out server_noPrivateKey_forJWT.crt
6. Certificates from a Trusted Root Authority must be installed on the Microsoft IIS server hosting QlikView AccessPoint in the Trusted Roots and Personal Folder as 'local machine' in the MMC certificate manager.
7. If not using the self-signed cert mentioned above, follow the instructions here to generate a CSR for submission to the Certificate Authority of choice:
   
   Deploying Qlik NPrinting > Security > Platform security > Certificates > Managing keys and certificates 
   1. Open the processed exported .crt file and copy the contents to the JWT settings in ON Demand within the NPrinting web console.
   2. Use the thumbprint of the third party certificate to install the On-Demand components
   3. If using a wild card certificate, make sure to:Install NPrinting On-Demand Components using the fully qualified path name and port of the NPrinting Server ie: https://myNPrintingServer.qlik.com:4993
      • From April 2019 and earlier versions: Export the Qlik Sense certificates using the fully qualified name of the Qlik NPrinting server (ie: myNPrintingServer.qlik.com) and re-import those certificates on the NPrinting Server using the NPrinting certificate installation tool. See certificate installation steps in Help > Deploying Qlik NPrinting > Qlik NPrinting installation > Connecting Qlik NPrinting with Qlik Sens
      • From June 2019 release of NPrinting, you may connect to multiple Qlik Sense servers. It is no longer necessary to use the certificate import tool.
        • It is therefore critical to update the client.pfx files for all connected Qlik Sense servers that are stored in the "C:\Program Files\NPrintingServer\Settings\SenseCertificates" folder. For information about connecting to multiple Qlik Sense services see Connect NPrinting Server to Multiple Qlik Sense servers.
        • Ensure that each client.pfx file in renamed to recognize with QS server it was exported from.

To verify that the thumbprint in the ON Demand installation matches the certificate thumbprint:

See image below:

Path to the On-Demand .json file on the QV IIS server where the On-Demand components is as follows: 

C:\Program Files\QlikView\Server\QlikViewClients\QlikViewAjax\htc\addons