Sometimes there is a need to test which user-groups are being returned for a specific user in Active Directory by Directory Service Connector. This may be useful in troubleshooting document availability for the specific user, when authorization (access) is based on group membership in Active Directory.
In QlikView Server prior to v11, group membership for a user could be verified by sending a request to the Directory Service Connector in the format http://localhost:4730/qtds.asmx?ResolveGroups&_user=Domain\User
. However, since the introduction of QlikView Server 11 and up, there is no built-in way of doing this.
This article outlines how to use QlikView PowerTools and the QlikView Management Service API to verify group resolution over the Directory Service Connector in QlikView.
QlikView PowerTools installed on the server where the test is to take place. The PowerTools can be found on QlikView Community. http://community.qlikview.com/blogs/supportupdates/2011/11/08/power-tools-for-qlikview-now-available
First step is to start the PowerTool located in the QMSClient folder called QMSAPIClient.exe. This file will be availabe in the directory you chose to install the PowerTools to. This presents you with this view:
We then need to figure out the ID of the Services in QlikView. As these are dynamically identified, we need to make a call to the Services to get the ID each of them are using in the tested installation. If you enter a search term in the "search" box as below, it narrows down the possible APIs to use. So in this case, enter "GetServices" and select it.
Click in the box labelled "Value" and you will get a popup that looks like below, where you can select which Service to get the details for.
Select "QlikViewDirectoryServiceConnector" from the list.
Press "Execute". This asks the Service for its details.
Expand the  Return value to see the details fro the Directory Connector Service.
You then need to select a different API call, named "ResolveUserGroups"
Then you need to enter the ID of the Directory Service Connector as the Guid for the ResolveUserGroups API Call by copying it and pasting it in to the Value box as seen in the Screenshot. You then need to add the user you want to test for grups in the last box, in the format DOMAIN\USERNAME. After that information is complete, press "Execute"
This call will result in a list of the grups the user belongs to in the results pane. This information can then be matched agaist the groups with access to the Document you are troubleshooting.