Anonymous users accessing QlikView Server will do this in the context of the account IQVS_<NETBIOSNAME>, which by default is created as a local user account.
If a cluster is set up, the account must be created as a domain user account, making it available to all nodes in the cluster.
Note: The above does not apply if running in DMS mode, only when NTFS authorization is being used.
The location of the account being used for anonymous access can be changed in QlikView Management Console:
- Go to System - Setup
- Select the QlikView Server resource in the left pane
- Go to the Security tab
Changing the account to a domain user account in the GUI may however render an error:
"Error Account: Failed to create account IQVS_NetBIOSname, Access is denied."
When switching the anonymous account to a domain user account, QlikView Server will attempt to create the account on the domain, if it does not already exist. This will be done in the context of the account running the QlikView Server service, which may not have sufficient privileges to create a new account on the domain.
As of version 11, it is possible to manually create this account via a user that has enough privileges on the domain to create accounts.
- Create a new domain account.
- Name the account IQVS_NETBIOSDomainName, where NETBIOSDomainName is the short name of the domain.
Example: If the domain is mydomain.com, the NETBIOSDomainName is MYDOMAIN and the account created should be named IQVS_MYDOMAIN
- Set a password to comply with any policies enforced in your organization
- Once the account is created and populated in Active Directory, change the setting for Anonymous Account in QlikView Management Console to On Domain (see picture above)
- Restart QlikView Server service
- Change NTFS permissions on any files/folders that should be accessible for anonymous users and make sure to give Read-permission to the domain account created above.