User accounts
You must set up several user accounts in order to successfully install Qlik NPrinting. Windows user accounts are created and managed with your Windows server administration tools.
You must create these Windows user accounts before you install Qlik NPrinting:
- Windows Qlik NPrinting Server services administrator
- Windows Qlik NPrinting Engine service administrator
- Qlik NPrinting repository database superuser
- Qlik NPrinting repository database administrator
Windows Qlik NPrinting Server services administrator
The Qlik NPrinting Server services administrator runs the following services:
- Qlik NPrinting scheduler service
- Qlik NPrinting web engine
You should create a dedicated Windows user account to install Qlik NPrinting Server and run the associated services. This ensures that there are no conflicts with other Windows services on the same computer. If you are only installing one instance of Qlik NPrinting Engine on the same computer as the Qlik NPrinting Server, you can use the same Windows user account for all Qlik NPrinting services on that computer. However, it is a good practice to have different users for different services. Some processes opened by Qlik NPrinting are also opened by Qlik Sense. It is easier to troubleshoot issues if you can quickly see which user or program caused the error.
You are prompted to enter these credentials on the Service logon credentials screen during the Qlik NPrinting Server installation. You must also use these credentials when prompted during the activation of Qlik NPrinting scheduler service and Qlik NPrinting web engine.
Requirements
The Qlik NPrinting Server services administrator must:
- Be a member of the local Administrators group.
- Have Log on as a service rights.
Changing the Qlik NPrinting Server services administrator
Do the following:
- Stop the Qlik NPrinting scheduler service.
- Stop the Qlik NPrinting web engine service.
-
Change the user account on Qlik NPrinting scheduler service and Qlik NPrinting web engine.
These two services must be run by the same user.
- Start the two services.
Windows Qlik NPrinting Engine service administrator
The Qlik NPrinting Engine service administrator runs the Qlik NPrinting Engine service.
You should create a dedicated Windows user account to install Qlik NPrinting Engine and run the associated services. This ensures that there are no conflicts with other Windows services on the same computer. If you are only installing one instance of Qlik NPrinting Engine on the same computer as the Qlik NPrinting Server, you can use the same Windows user account for all Qlik NPrinting services on that computer. However, it is a good practice to have different users for different services. Some processes opened by Qlik NPrinting are also opened by Qlik Sense. It is easier to troubleshoot issues if you can quickly see which user or program caused the error.
You are prompted to enter these credentials on the Service logon credentials screen during the Qlik NPrinting Engine installation.
Requirements
The Windows service administrator must:
- Be a member of the local Windows Administrators group.
- Be a domain user.
- Have Log on as a service rights.
Limitations
You can only install one instance of Qlik NPrinting Engine on each computer.
Additional Qlik Sense requirements
To connect Qlik NPrinting to Qlik Sense apps:
-
Add Qlik Sense server certificates to the Qlik NPrinting Engine. See: Configuring server certificate validation for Qlik Sense connections
- The same Windows user account can be used for all Qlik NPrinting Engine installations if you are only connecting to Qlik Sense.
- The Windows user account that runs the Qlik NPrinting Engine service must have:
- RootAdmin authorization configured in the QMC.
A domain user account that is a member of the same domain as the Qlik NPrinting server and the Qlik Sense server.
Additional QlikView requirements
To connect Qlik NPrinting to QlikView documents:
- You must use a different Windows user account for each Qlik NPrinting Engine instance if you are connecting to QlikView.
- The Windows user account must belong to the local QlikView Administrator group on all QVS servers used by Qlik NPrinting.
- The Windows user account that runs the Qlik NPrinting Engine service must have one of the following:
- A named user Client Access License (CAL) that is manually assigned to the Qlik NPrinting Engine service user active directory account, on the QlikView Server.
- An active license for QlikView Desktop, which must be installed on the Qlik NPrinting Engine computer.
Additional QlikView Cluster requirements
To create a connection to a QlikView Cluster:
- You must use a different Windows user account for each Qlik NPrinting Engine instance if you are connecting to QlikView.
- The Windows user account that runs the Qlik NPrinting Engine service must have:
- Be part of QlikView Administrators security group in all the nodes of the cluster.
- Be part of QlikView Management API security group on the computer where QMS runs. This group must be added manually. See the QlikView Server Reference Manual for more information.
Changing the Qlik NPrinting Engine services administrator
You can change the services user account on all releases, except for:
- November 2018
- February 2019
- April 2019
- June 2019
If you have one of these versions, you will need to upgrade to Qlik NPrinting September 2019 or higher to change services user accounts.
Do the following:
- Stop the Qlik NPrinting Engine service.
- Change the service user account.
- Start the Qlik NPrinting Engine.
The engine status may not immediately switch online if you have recently upgraded from one of the versions listed above that do not support the service account change.
Do the following:
- In the Qlik NPrinting web console, go to Admin > Engine manager.
- Remove and recreate the related engine entry.
- Fill out the certificate form to send the new certificates to the engine.
Qlik NPrinting repository database superuser
The Qlik NPrinting repository database superuser is a role that bypasses all permission checks in the PostgreSQL database, except the right to log in. It is not a Windows, or Qlik NPrinting user, it is a PostgreSQL user configured during the installation of the Qlik NPrinting repository.
The Qlik NPrinting repository is installed with Qlik NPrinting Server. You are prompted to enter a password for the superuser on the Repository database superuser password screen during the Qlik NPrinting Server installation.
Qlik NPrinting repository database administrator
The Qlik NPrinting repository database administrator is a role that has administrative privileges in the Qlik NPrinting repository. It is not a Windows, or Qlik NPrinting user, it is a PostgreSQL user configured in the repository database. This user is used the first time you log into Qlik NPrinting.
These credentials do not provide access to QlikView documents or Qlik Sense apps. The Qlik NPrinting repository only contains information about the structure of the reporting system.
You are prompted to enter an Administrator username, Email address, and Password to create the Qlik NPrinting Server administrator on the Administrator credentials screen during the Qlik NPrinting Server installation.
Requirements
The email address must be compliant with the HTML specification explained by the W3C. You cannot use comments, quoted strings and special characters: []/();:'"<>
Troubleshooting
User access is denied with message "Your credentials did not work"
Possible cause
You receive a Windows dialogue that says "Your credentials did not work". You are trying to log into Qlik NPrinting using the incorrect domain. Your access is denied because your system has separate domains and standalone servers.
Proposed action
All supported configurations must be implemented within a single Active Directory domain. This includes:
- Qlik NPrinting Server
- Qlik NPrinting Engine
- QlikView Server
- Windows Qlik NPrinting Server services administrator
- Windows Qlik NPrinting Engine service administrator
- Qlik NPrinting repository database superuser
- Qlik NPrinting repository database administrator
If you are using JWT or SAML, user accounts do not need to be in the same domain, but must be within a domain that Qlik NPrinting can authenticate within the same Active Directory Forest. For more information, see: JWT authentication and Security Assertion Markup Language (SAML) single sign-on (SSO).