Although Configurable LDAP Directory Service Provider (DSP) is successfully configured and the directory is searchable in the QlikView Management Console, trying to log on using LDAP credentials will not work.
If auditing is configured in Windows to log failed login attempts, the following errors may be found in the Windows Security Event log:
An account failed to log on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: xxxxxxx
Account Domain: XXXX
Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xc000006d
Sub Status: 0xc000006a
Configurable LDAP DSP does not handle the authentication process for a user.
Configurable LDAP DSP in QlikView Server is used to retrieve user attributes from a Directory Service, using generic LDAP. For example, attributes for a specific user could be:
- Full name
- Group membership
- Email address
- etc.
Information retrieved may be used to authorize access to QlikView documents based upon any of the attributes (most common is to authorize access for a specific group, hence group membership for a user is required).
The authentication process for a user is not handled by the Configurable LDAP DSP. This needs to be handled elsewhere, using for example 3rd party SSO solutions.
Once the user is authenticated, the identity of the user may be used to grant access to QlikView documents the user is authorized to use.