Local directory users can't logon to AccessPoint when using IIS
Article Number: 000003694 | Last Modified: 2019/01/17
QlikViewServer connected to a domain.
You want to use a local user directory, or any other directory using NTLM.
You want to use IIS instead of QlikView WebServer, as it provides more options and a bit more control, although everything works with QlikView WebServer.
When logging on as a regular user you get a "Login Failed" upon hitting "Submit" on the login-page.
Logging on as an administrator might get you through, though this is mostly dependent on using the same username/password.
This article explains why it doesn't work with IIS to log on.
Local user directories are not dependent on domains. This means that providing trust for a local user identity will not go through the domain and the KDC (Key Distribution Center, in charge of service tickets for trust), the local user accounts will depend on NTLM authentication.
If a QlikViewServer is a member of a domain and the services are running with a domain account, it is likely that the authentication method through IIS will try to only use Kerberos, despite being set to "Negotiate", since providing trust in a domain will go through the domain controller and the KDC.
Negotiate means that it will actively try to use Kerberos, and if the "negotiator" doesn't allow that, NTLM is used.
NTLM trust does not go through a domain controller, which is what the IIS is trying to direct trust through.
QlikView WebServer is also using Negotiate by default, but is our own product and is programmed in a different way. It is not a Microsoft product and is intended to easier work with other user directories. Thus one might experience that it is working with QlikView WebServer instead. QlikView WebServer can be set to only use NTLM as well, but that is another chapter.
1. Open IIS Manager
2. Go to the SERVERNAME
> Default Web Site
3. Double click on Authentication
4. Mark Windows Authentication
, and click Providers
to the right in the menu bar.
5. Remove Negotiate
6. It should now work fine.