QlikView WebTicket based authentication: Local groups not fetched correctly

When authenticating as a domain user with WebTicket in QlikView, you may notice that local groups are not fetched correctly. This behavior is working as designed.

This article explains why is that and how to work around the issue.

When WebTicket is used, the authentication is delegated to a 3rd party authentication system.

The 3rd party system will have to supply the groups that the user is member of.

 

If the list of groups is not supplied, the webserver will use the Directory service connector (DSC) to try to lookup groups. It will not do a windows logon since QlikView will not know if it is a windows user, and won't have the full credentials/password.

The DSC will look in the directory service provider that the user is part of, and not all others.

Therefore, in the case the user is a domain user it will not do a lookup in the local server directory. This is a working as designed.

In the case where default or alternate login page is used, QlikView code (in QlikView WebServer or setting service for IIS) will do the authentication and will do the group lookup with the supplied credentials/login information.

 

So the customer/3rd party system will have to do the group lookup in their authentication system and supply the grouplist for this to work.

In order to solve this issue, the third party authentication system should look up the groups the user belongs to itself and supplies it during the ticket request.

For example, the ticket request will be sent with the following body:

<Global method="GetWebTicket"><UserId>DOMAIN\User7</UserId>
<GroupList>
<string>QLIKVIEWSERVER\localgroup</string>
<string>DOMAIN\domaingroup</string>
</GroupList>
<GroupsIsNames>true</GroupsIsNames>
</Global>

See more details in QlikView Server: Request a ticket with Postman regarding how to request a ticket in QlikView.