
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Qlik Sense authentication fails with X509N Bad User Name - Login Failures
Feb 27, 2023 6:06:05 AM
Oct 23, 2018 5:03:27 PM
The Windows Security Event log reports the following event:
event ID 4768, Task Category "Kerberos Authentication Service". Account name for these entries will be "X509N:<S>CN=QlikClient
Resolution:
Without a Multi-Cloud/Hybrid setup
If you are a customer currently not using a Multi-Cloud/Hybrid setup, meaning you are not distributing Apps from Client Managed into SaaS.
Option 1:
- Stop the Qlik Sense Services
- Open the following path: C:\Program Files\Qlik\Sense\Repository\
- Open Repository.exe.config
- Set "EnableDotNetWebSockets" to true.
- If the Qlik Services are running using a non-local administrator account, then bootstrapping needs to be run after the changed configuration. The fix is not supported by Windows 7.
Option 2:
It is possible that the error is still seen after option one is applied. It is found that due to the current architecture following services are triggering the error:
[hybriddeploymentservice]
[appdistributionservice]
[qib-webchat-service]
If the Qlik Sense environment is not using Multi-cloud deployment, you may apply the following workaround by disabling the following two services:
[hybriddeploymentservice]
[appdistributionservice]
To do this:
- Open the file "services.conf" of the Qlik Sense installations (it is typically located at C:\ProgramFiles\Qlik\Sense\Ser
viceDispatcher ). - Make a backup of "services.conf" file first
- Go to the section defining the service in question by adding the row "Disabled=true" like this:
[hybriddeploymentservice]
Disabled=true
Identity=Qlik.hybrid-deployment-service
DisplayName=Hybrid Deployment Service
ExePath=dotnet\dotnet.exe UseScript=false
[appdistributionservice]
Identity=Qlik.app-distribution-service
DisplayName=App Distribution Service
ExePath=dotnet\dotnet.exe
UseScript=false - The "Qlik Sense Service Dispatcher" service needs to be restarted for the setting to take effect.
If you are not using Qlik Webchat, you can also disable [qib-webchat-service]
by following same steps as above.
With a Multi-Cloud/Hybrid setup
If you are a customer currently using a Multi-Cloud/Hybrid setup, meaning you are distributing Apps from Client Managed into SaaS.
With a multi-cloud setup, there is no complete workaround available as of today. It is important to mention that this is not an issue that affects in any way your security and/or stability of your Client Managed deployment. This is a result of how affected Qlik Sense .NET microservices are handling certificates in .NET Core technology. To address this shortcoming, a significant re-design of current architecture would be required that is currently not in the pipeline, hence would recommend submitting a product ideation.
To limit the number of events in question, if you are not using Qlik Webchat, you can disable [qib-webchat-service]
- see step-by-step instructions in the previous section.
Environment:
Qlik Sense Enterprise on Windows
Internal Investigation ID(s):
QLIK-87774, QB-274. Working as intended, please apply the resolution given in this article.

- Mark as Read
- Mark as New
- Bookmark
- Permalink
- Report Inappropriate Content
One of our clients has reported he issue from domain controller. User Name - X509N:<S>CN=QlikClient;
Event Type : Failure ; Failure Reason- Bad User name.
I have applied resolution 1 and the error was repeating. So I applied resolution 2 .
Is this issue specific to any Qlik version? What should b my next step , if the error persists?

- Mark as Read
- Mark as New
- Bookmark
- Permalink
- Report Inappropriate Content
Hello @fabdulazeez
Please post your question in our active forums to make use of our active user base and the support engineers monitoring our forums.
The correct forum is: Deployment and Management.

- Mark as Read
- Mark as New
- Bookmark
- Permalink
- Report Inappropriate Content
Hi Alan_Slaughter,
We have the same issue reported from our domain controllers.
We have applied the mentioned two solutions and issue still exists in our proxy server.Though we don't have any issues with the qlik environment.Failed login requests are causing performance issues in domain controller.
Could you please suggest an alternate approach.
Thanks & Regards
Diwakar

- Mark as Read
- Mark as New
- Bookmark
- Permalink
- Report Inappropriate Content
Hello @diwakarreddy
If this does not resolve the issue, then you are likely looking at a different root cause. I would recommend posting about the issue in our community (Qlik Sense Management and Deployment ) or contacting support directly should that help you resolve the issue.
All the best,
Sonja


- Mark as Read
- Mark as New
- Bookmark
- Permalink
- Report Inappropriate Content
Thank you for the article. It fixes the issue on Aug 2023 P6 version too!
FMa