This guide briefly offers a step-by-step process on how to set up key-pair authentication in Snowflake using Qlik Talend Studio at Job level

The process can be summarized in three steps:

1. Creating the .p12 file with Open SSL
2. Configuring Snowflake
3. Configuring Qlik Talend Studio at Job Level

Creating the .p12 File with Open SSL

The .p12 file contains both the private and public keys, along with the owner's details (such as name, email address, etc.), all certified by a trusted third party. With this certificate, a user can authenticate and identify themselves to any organization that recognizes the third-party certification. 

Talend tSetKeyStorecomponent  itself can only take in .jks or .p12/.pfx format. If you are using PKCS8 format, you need to convert your p8 certs into a supported format. 

1. Generate the key with the following command line prompt:

   openssl genpkey -algorithm RSA -out private.key -aes256

   This will generate a private key (private.key) using the RSA algorithm with AES-256 encryption. You'll be prompted to enter a passphrase to protect the private key.
   
   
   
   
   
   
2. Generate a self-signed certificate using the following command line prompt:
   

   openssl req -new -x509 -key private.key -out certificate.crt -days 1825

   This command generates a self-signed certificate (certificate.crt) that is valid for 5 years. You will be prompted to enter details like country, state, and organization when generating the certificate.
   
   
   
   
3. Once you have both the private key (private.key) and certificate (certificate.crt), please create the .p12 file using the following command line and name your key alias.
   

   openssl  pkcs12 -export -out keystore.p12 -inkey private.key -in certificate.crt  -name "abe"

   And check the  created  .p12 file information with below command:
   

   openssl pkcs12 -info -in keystore.p12 or keytool -v -list -keystore keystore.p12

   
   
   
   
   
4. Generate a public key with the following command line:
   

   openssl x509 -pubkey -noout -in certificate.crt > public.key

   
   
   

Configuring Snowflake : 

The USERADMIN role is required to perform the Snowflake configuration. Open your Snowflake environment and ensure you have a worksheet or query editor ready to execute the following SQL statements. .

1. For this step, you will create the necessary Snowflake components—database, warehouse, user, and role for testing purposes. If you already have an existing setup or example, feel free to re-use it

   -- Drop existing objects if they exist
   DROP DATABASE IF EXISTS ABE_TALEND_DB;           -- Drop the test database
   DROP WAREHOUSE IF EXISTS ABE_TALEND_WH;          -- Drop the test warehouse
   DROP ROLE IF EXISTS ABE_TALEND_ROLE;             -- Drop the test role
   DROP USER IF EXISTS ABE_TALEND_USER;             -- Drop the test user
   
   -- Create necessary objects
   CREATE WAREHOUSE ABE_TALEND_WH;                  -- Create the warehouse
   CREATE DATABASE ABE_TALEND_DB;                   -- Create the test database
   CREATE SCHEMA ABE_TALEND_DB.ABE;                 -- Create the schema "ABE" in the test database
   
   -- Create the test user
   CREATE OR REPLACE USER ABE_TALEND_USER
       PASSWORD = 'pwd!'                            -- Replace with a secure password
       LOGIN_NAME = 'ABE_TALEND_USER'
       FIRST_NAME = 't'
       LAST_NAME = 'tt'
       EMAIL = 't.tt@qlik.com'                      -- Replace with a valid email
       MUST_CHANGE_PASSWORD = FALSE
       DEFAULT_WAREHOUSE = ABE_TALEND_WH;
   
   -- Grant necessary permissions
   GRANT USAGE ON WAREHOUSE ABE_TALEND_WH TO ROLE SYSADMIN;   -- Grant warehouse access to SYSADMIN
   
   CREATE ROLE IF NOT EXISTS ABE_TALEND_ROLE;                  -- Create the custom role
   GRANT ROLE ABE_TALEND_ROLE TO USER ABE_TALEND_USER;         -- Assign the role to the user
   
   GRANT ALL PRIVILEGES ON DATABASE ABE_TALEND_DB TO ROLE ABE_TALEND_ROLE;                -- Full access to the database
   GRANT ALL PRIVILEGES ON ALL SCHEMAS IN DATABASE ABE_TALEND_DB TO ROLE ABE_TALEND_ROLE; -- Full access to all schemas
   GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA ABE_TALEND_DB.ABE TO ROLE ABE_TALEND_ROLE;-- Full access to all tables in schema
   GRANT USAGE ON WAREHOUSE ABE_TALEND_WH TO ROLE ABE_TALEND_ROLE;                        -- Grant warehouse usage to custom role
   
   -- Verify user creation
   SHOW USERS;
   
   -- Create a test table and validate setup
   CREATE TABLE ABE_TALEND_DB.ABE.ABETABLE (
       NAME VARCHAR(100)
   );
   
   -- Test data retrieval
   SELECT * FROM ABE_TALEND_DB.ABE.ABETABLE;
   

2. For this step, please assign the public key to the Snowflake test user created earlier. To do this, you'll need do the following:
   • Locate public.key and open it in an editor (such as Notepad++)
   • Copy the public key displayed between BEGIN PUBLIC KEY and END PUBLIC KEY
     
     
     
     
   • In the Snowflake environment, open a worksheet or query editor to run the following SQL statements. You will add the previously generated public key to our user and be sure to replace it with your own key. 

     DESCRIBE USER

     And to verify that the key was successfully added. 

     ALTER USER ABE_TALEND_USER SET RSA_PUBLIC_KEY=public key ';
     DESCRIBE USER ABE_TALEND_USER;

     

3. Now we’ll verify that the configuration is correct. In your Snowflake environment, open a worksheet or query editor, run the following SQL statements, and copy the results (an sha256 hash of our public key ) into a Notepad or any text editor for reference. 
   
   

   DESC USER ABE_TALEND_USER;
   SELECT SUBSTR((SELECT "value" FROM TABLE(RESULT_SCAN(LAST_QUERY_ID()))  WHERE "property" = 'RSA_PUBLIC_KEY_FP'), LEN('SHA256:') + 1);

   
   

   Using OpenSSL, we will calculate the SHA-256 hash of the public key and compare it with the one previously generated by Snowflake to ensure they are matched.
   To do that use the following OpenSSL command:

   openssl rsa -pubin -in public.key -outform DER | openssl dgst -sha256 -binary | openssl enc -base64

   
   
   
   If the hash matches, proceed to the Talend Studio configuration.

Configuring Qlik Talend Studio at Job Level : 

1. Launch your talend studio and drag both tSetKeyStore and tDBConnection(Snowflake) components from Palette to Designer Tab

   
   

2. In the Basic settings of tSetKeyStore component, enter the path to the  keystore .p12 file in double quotation marks in the KeyStore file field :

   
   
   

   
3. Use the Key Alias set in the keystore. p12 file before for Snowflake DB Connection ("abe", for this example) : 
   
   
   
   

    

4. Please test the connection to see if the key-pair authentication you set up works
   
   
   
   

Related Content

If you are looking for how to set up key-pair authentication in Snowflake using Qlik Talend Studio at Studio Level, please refer to this article:

Talend-Job-using-key-pair-authentication-for-Snowflake-fails

Environment

Talend Studio 

Erlang/Open Telecom Platform (OTP) has disclosed a critical security vulnerability: CVE-2025-32433.

Is Qlik NPrinting affected by CVE-2025-32433?

Resolution

Qlik NPrinting installs Erlang OTP as part of the RabbitMQ installation, which is essential to the correct functioning of the Qlik NPrinting services.

RabbitMQ does not use SSH, meaning the workaround documented in Unauthenticated Remote Code Execution in Erlang/OTP SSH is already applied. Consequently, Qlik NPrinting remains unaffected by CVE-2025-32433.

All future Qlik NPrinting versions from the 20th of May 2025 and onwards will include patched versions of OTP and fully address this vulnerability.

Environment

• Qlik NPrinting

The Qlik Sense Mobile app allows you to securely connect to your Qlik Sense Enterprise deployment from your supported mobile device. This is the process of configuring Qlik Sense to function with the mobile app on iPad  / iPhone.

This article applies to the Qlik Sense Mobile app used with Qlik Sense Enterprise on Windows. For information regarding the Qlik Cloud Mobile app, see Setting up Qlik Sense Mobile SaaS. 

Content:

• Pre-requirements (Client-side)
• Configuration (Server-side)
• Update the Host White List in the proxy
• Configuration (Client side)

Pre-requirements (Client-side)

See the requirements for your mobile app version on the official Qlik Online Help > Planning your Qlik Sense Enterprise deployment > System requirements for Qlik Sense Enterprise > Qlik Sense Mobile app

Configuration (Server-side)

Acquire a signed and trusted Certificate.

Out of the box, Qlik Sense is installed with HTTPS enabled on the hub and HTTP disabled. Due to iOS specific certificate requirements, a signed and trusted certificate is required when connecting from an iOS device. If using HTTPS, make sure to use a certificate issued by an Apple-approved Certification Authority.
Also check Qlik Sense Mobile on iOS: cannot open apps on the HUB  for issues related to Qlik Sense Mobile on iOS and certificates.

For testing purposes, it is possible to enable port 80.

(Optional) Enable HTTP (port 80).

1. Open the Qlik Sense Management Console and navigate to Proxies.
2. Select the Proxy you wish to use and click Edit Proxy.  
3. Check Allow HTTP 

Update the Host White List in the proxy 

If not already done, add an address to the White List:

1. In Qlik Management Console, go to CONFIGURE SYSTEM -> Virtual Proxies
2. Select the proxy and click Edit
3. Select Advanced in Properties list on the right pane
   
   

    

4. Scroll to Advanced section in the middle pane
5. Locate "Allow list"
   
   

    

6. Click "Add new value" and add the addresses being used when connecting to the Qlik Sense Hub from a client. See How to configure the WebSocket origin allow list and best practices for details. 
   
   

Generate the authentication link:

An authentication link is required for the Qlik Sense Mobile App.

1. Navigate to Virtual Proxies in the Qlik Sense Management Console and edit the proxy used for mobile App access
2. Enable the Client authentication link menu in the far right menu.
3. Generate the link.

NOTE: In the client authentication link host URI, you may need to remove the "/" from the end of the URL, such as http://10.76.193.52/ would be http://10.76.193.52 

Associate User access pass

Users connecting to Qlik Sense Enterprise need a valid license available. See the Qlik Sense Online Help for more information on how to assign available access types.
Qlik Sense Enterprise on Windows > Administer Qlik Sense Enterprise on Windows > Managing a Qlik Sense Enterprise on Windows site > Managing QMC resource > Managing licenses

• Managing professional access
• Managing analyzer access
• Managing user access
• Creating login access rules

Configuration (Client side)

1. Install Qlik Sense mobile app from AppStore.
2. Provide authentication link generated in QMC
   • Open the link from your device (this can be also done by going to the Hub, clicking on the menu icon at the top right and selecting "Client Authentication"), the installed application will be triggered automatically, and the configuration parameters will be applied.
   •  Enter user credentials for QS server

An endpoint security system may have flagged the Qlik NPrinting Designer process as it accesses the svchost.exe file in C:\Windows\SysWOW64\.

Is this access attempt considered a security risk?

Qlik NPrinting Designer may try to read svchost.exe during the Office embedding process, but it never opens or edits the file. This excludes any possible security risks.  

Will the Qlik NPrinting designer function as expected without access to the file?

Qlik NPrinting Designer was tested without access to svchost.exe and functions as expected even when access has been blocked.

Environment

• Qlik NPrinting

After deploying and subsequently undeploying a route, even when the route is undeployed, it causes issues for the deployment of subsequent routes. Attempts to deploy a different route are met with errors stating that unable to find the path of the existing undeployed route.

Resolution

The undeployed route left traces, ideally requiring the individual uninstallation of the KAR file(s).

1. Stop Talend Runtime. 
2. Stop Remote Engine.
3. Start Talend Runtime and allow it approximately five minutes to ensure it is fully prepared to receive JMX requests from Remote Engine.
4. In Talend Runtime, perform a 'kar:list' command and verify that no entries are displayed. For each specified output, you must execute the 'kar:uninstall' command.
5. Start Remote Engine.

Environment

• Talend Cloud 8.0.1

For general installation instructions and backwards compatibility information, see SAP Connector installation.

Qlik SAP Connector versions 8.0.1 or earlier include the SAP libraries.

Qlik SAP Connector versions 8.0.2 and later do not include the SAP libraries. You can download the SAP libraries from the SAP support download portal in accordance with SAP regulations after the upgrade of the Connector was performed. The Connector can be upgraded without issues first.

Index:

• Qlik SAP Extractor Connector
• Not using Qlik SAP Extractor Connector:
• Downloading and installing the SAP Libraries for connector 8.0.2 or later:

Qlik SAP Extractor Connector

Step 1:

For the SAP Extractor connector, follow the below steps before upgrading:

1. Open Services.MSC, find Qlik SAP Network Service, and then click "Stop."
2. Open cmd as an administrator and change the directory to C:\Program Files\Common Files\QlikTech\Custom Data\QvSAPConnector 
3. Run the SrvService Console.bat file.
4. Choose the option to uninstall the Qlik SAP Network Service. 

Step 2:

Once the service has been uninstalled, please proceed as follows:

1. Uninstall the SAP connector.
2. Install the new version SAP connector.

Step 3:

After installing the updated version of the Sap connector, follow the steps below to install the Qlik SAP extractor connector service "Qlik SAP Network Service."

1. Open cmd as an administrator and change the directory to C:\Program Files\Common Files\QlikTech\Custom Data\QvSAPConnector 
2. Run the SrvService_Console.bat file.
3. Choose option 2 to install the Qlik SAP Network Service. 
4. Open Services.MSC, find Qlik SAP Network Service, and then click "Start."

Note: Restart all the Qlik Sense Services if the installation is on a Qlik Sense system. The SAP Connector is not available in Qlik Sense until all the services are restarted.

Not using Qlik SAP Extractor Connector:

Examples: SQL, Bex, Info provider, Report, BW etc.

Once the service has been uninstalled, please proceed as follows:

1. Uninstall the SAP connector.
2. Install the new version SAP connector.

Downloading and installing the SAP Libraries for connector 8.0.2 or later:

The "SAP Connector for Microsoft.NET" and "SAP NW RFC SDK" versions will change for each connector upgrade based on SAP security patch releases, refer to the help page for additional information. Installing the connectors - Windows

1. Log into the SAP Support Portal with an S-user ID.
   
   
2. Go to SAP Connector for Microsoft .NET and search for: SAP Connector for Microsoft .NET, 64-bit, version 3.1 or later. This library is used by the Connectors with file extension .exe and contains sapnco.dll and sapnco_utils.dll.

3. Download these library files. Double-click the SapNCox64Setup.exe file. The installation wizard starts, and the files are installed in Global Assembly Cache (GAC).

4. Go back to the SAP Support Portal and search for: SAP NW RFC SDK, 64-bit, version 7.50 or later. This library is used by the legacy connectors with file extension .dll.

5. Download and unzip the library. The library contains all required files.
   • icudt50.dll
   • icuin50.dll
   • icuuc50.dll
   • libsapucum.dll
   • sapnwrfc.dll
     
     
6. Place the files in this folder: C:\Program Files\Common Files\QlikTech\externals

Microsoft ended support for Microsoft XML Parser and Microsoft XML Core Services (MSXML) 4.0 on April 12, 2014 and provides no further support.

Does uninstalling or disabling XML or MSXML cause any risks to QlikView, Qlik Sense, or Qlik NPrinting? 

No risk is posed to QlikView, Qlik Sense, or Qlik NPrinting if  Microsoft XML Parser and Microsoft XML Core Services are disabled.

The information in this article is provided as-is and to be used at own discretion. Depending on tool(s) used, customization(s), and/or other factors ongoing support on the solution below may not be provided by Qlik Support.

Environment

Qlik Sense Enterprise on Windows 
QlikView 
Qlik NPrinting 

• Timeline
• Standard run vs third-party run
• Standard runs
• Third-party runs
• Possible third-party runs
• Transition of existing entitlements
• Starting Jan 30th (introduction of third-party runs, current packaging still applies)
• Starting April 2nd (switch to new packaging)
• Packaging details
• FAQ

 

Timeline

The below timeline illustrates how the various stages of this packaging update will happen. In-between each stage should be sufficient time to analyze your usage and prepare for the enforcement.

• January 30th – Introduction of third-party runs
• April 2nd – New third-party packaging is available for purchase 
• May 1st – Enforcement
  • Third-party limits for seat-based licenses
  • Third-party overages for capacity licenses

Standard run vs third-party run

Standard runs

An automation run is considered a standard run if it only executes blocks from the following categories:

• All Qlik connectors (Qlik Cloud Services, Qlik Reporting, Qlik AutoML, Qlik …)
• Base blocks (excluding Call URL & Cloud Storage)
• Mail & Microsoft Outlook

Example:

 

Third-party runs

An automation run is considered a third-party run if it executes any blocks that are not in the standard connector categories.

As a rule of thumb, a standard run will execute one or more blocks from third-party connectors. Among others, third-party connectors are connectors like Slack, Amazon S3, Microsoft Excel, Call URL. A full overview of all automation connectors if available here.

Example:

Every run of this automation will execute the Send Message (Slack) block.
This will make every run a third-party run as the Slack connector is a third-party connector.
The “Contains third-party blocks” label indicates that the automation contains an active third-party block.

Possible third-party runs

For a run to be considered a third-party run, we only evaluate executed blocks. If the third-party blocks in the automation were not executed, the run will not count as a third-party run. A block not being executed could be caused by many factors like Condition blocks, Filter List blocks, deactivated third-party blocks, ...

This illustrates that an automation with a “Contains third-party blocks” label will not necessarily generate third-party runs on every run.

Example:

This automation will only execute the Send Message (Slack) block if the reload fails (from the Do Reload block). This means it will only generate third-party runs depending on the state of the Condition block.

Transition of existing entitlements

Starting Jan 30th (introduction of third-party runs, current packaging still applies)

1. Customers who are entitled to included runs will get these as third-party runs
2. Purchased runs will be converted to third-party runs
3. Renewals before the end of March will maintain the same included third-party runs until next renewal.

Starting April 2nd (switch to new packaging)

1. Every new purchase will be using the new packaging
2. Renewals will revert third-party runs to the edition included quantity of the new packaging + any purchase of third-party runs using the new packaging

Packaging details 

The below table provides an overview of the new packaging for automations that will come in effect on April 2, 2025. Please reach out to your account manager for quotes and pricing related questions. 

 

FAQ

1. Will max concurrency be shared across run types?
Yes, both run types will count towards the same max concurrency.

2. Will usage of Qlik APIs through the Call URL block or other generic connectors count towards third-party runs?
Yes, when these blocks and connectors are used to make API requests to Qlik APIs, they will still count towards third-party runs. If you are missing blocks or functionality in a Qlik connector, please create an improvement request on our Ideation portal or support an existing request.

3. Will the new packaging have an included amount of third-party runs?
Yes, the new packaging will continue to provide some third-party runs for most editions of Qlik Cloud. Details are available in the above section "Packaging details".

4. Why are some automations with third-party blocks missing the label "Contains third-party blocks"?
An automation will only receive the label when someone performs a manual run or saves it in the editor. We are planning a new update that will apply this label to all automations with active third-party blocks regardless of someone saving them or not.
Please note that regardless of this label being on an automation or not, automation runs will still be evaluated and receive a correct billable yes/no label.

With a filter and a data quality cleansing rule defined on the same column, the data warehouse task fails with the following error:

[ERROR ] [] sqlstate '42000', errorcode '1003', message 'SQL compilation error:

syntax error line 404 at position 24 unexpected 'WHEN'.' java.sql.SQLException: sqlstate '42000', errorcode '1003', message 'SQL compilation error:

syntax error line 404 at position 24 unexpected 'WHEN'.'

Resolution

This issue was caused by defect RECOB-6917. 

Fix Version: 

• Qlik Compose 2023.11 SP10 and later releases

Contact Support to obtain the relevant fixes.

Cause

RECOB-6917

Environment

• Qlik Compose

Connecting to data using a web file connection may fail with the following error if the connection is routed to an internet proxy.

Environment

• Qlik Sense Enterprise, any version

Resolution

The additional configuration will be required in the Settings.ini file.

1. Stop the Qlik Sense Engine and Dispatcher Services.
2. Add the following key values under [Settings 7]. Refer to How to modify Qlik Sense Engine's Settings.ini  
3. Sart the Qlik Sense Engine and Dispatcher Services.

[Settings 7]
UseProxyServerForWebFileConnectors=1
WebFileConnectorProxyServer=xxxx.xxxx.com (Replace this with your actual proxy URL)
WebFileConnectorProxyPort=8080(Replace with your proxy's port number)

Related Content 

Can not connect to web file using Web file Connector if the Qlik Sense Enterprise uses Proxy to connect to internet  

The video above demonstrates how to convert Qlik Sense Enterprise servers with Tokens to the Professional and Analyzer capacity licensing model.

The conversion breaks down like this:

• User Access Passes -> Professional
• Everyone else into Analyzer Capacity

Steps

1. Copy and Save existing User Access rules, storing for future reference.
2. Do the same for Login Access rules
3. Paste the Signed License Key (SLK) in the signed license box, and hit Apply
4. Recreate the Professional Access rules from scratch or copy and paste from the User Access Rule.
5. Validate the rule and click Apply
6. Recreate the Analyzer Capacity access rule from scratch or copy the Login Access rule
7. Validate the rule and click Apply

Environment

• Qlik Sense Enterpise

The information in this article is provided as-is and to be used at own discretion. Depending on tool(s) used, customization(s), and/or other factors ongoing support on the solution below may not be provided by Qlik Support.

Related Content 

Please refer to the Qlik Sense® License Conversion Policy dated March 2021 for details.

Transcript

Hello and welcome to this short video guide on upgrading a Qlik Sense token server to a Qlik Sense Professional and Analyzer subscription license.

Our starting point for this upgrade guide is a very simple Qlik Sense Enterprise server, which is using the token style license. That means users gain access using either a User Access or a Login Access pass. Token style Qlik Sense uses the legacy LEF license with a serial and control number activation. This will be replaced in the Professional and Analyzer model license with a Signed License Key (SLK).

Make sure that you copy or save the existing user access rules storing the rules for future reference. We will do the same for the login access rules. Copy and save the rule conditions for future reference.

When you're issued with your new Qlik Sense Enterprise Professional and Analyzer subscription license, you will be issued a new license key or a new tenant. You may continue to use the old Qlik Sense Enterprise token license for up to four months. This will allow you to stand up a new Qlik Sense Enterprise site with Professional Analyzer users in parallel, and transition over time; or do it in one big go.

In this example, we are going to upgrade an existing Qlik Sense token server using the Signed License Key to move it to the Professional and Analyzer user model. Paste the Signed License Key in the signed license box and hit apply. When the license is successfully applied, you will see the license number as well as a license summary on the summary page. In this example, we have 4 Professional Users, as well as 8,000 minutes of Analyzer Capacity per month. There are no user allocations carried over from the old token model.

We need to recreate the Professional access rules. You can create rules from scratch or copy and paste the old token rules to a new Professional allocation rule, like so. Make sure you validate the rule and then hit apply.

We will do the same thing for the Analyze Capacity access rule. Copy the old token access rule for login access and paste it in the analyze capacity access rule. Validate the rule and hit apply. A quick test will validate that the Professional user access rules are functioning correctly. And here we can see that a Professional user was successfully allocated according to the rule we've set up.

Now we will check that the Analyzer capacity allocation rule is also working as expected. Click on the license usage summary tab; and here you can see that 6 minutes of analyzing capacity have been consumed. Everything is working as expected.

Thank you for watching. We hope you found this video useful.

If you would like more information, take advantage of the expertise of peers, product experts, and technical support engineers by asking a question in the Qlik product forums on Qlik community; or check out the support program space. Here you can search for answers in the support knowledge base, learn directly from Qlik experts via support webinar like Techspert Thursdays, and don't forget to subscribe to the support update blog. Thanks for watching.

You may experience intermittent issues when accessing the Talend Administration Center (TAC), along with the following warning message if you are using MySQL as the database

Caused by: com.mysql.cj.exceptions.CJCommunicationsException: Communications link failure
Loading class `com.mysql.jdbc.Driver'. This is deprecated. The new driver class is `com.mysql.cj.jdbc.Driver'. The driver is automatically registered via the SPI and manual loading of the driver class is generally unnecessary.

And this issue is random and sometimes can be temporarily resolved by refreshing the Talend Administration Center page.

(ConnectionImpl.java:456) at com.mysql.cj.jdbc.ConnectionImpl.getInstance(ConnectionImpl.java:246) at com.mysql.cj.jdbc.NonRegisteringDriver.connect(NonRegisteringDriver.java:199) at java.sql.DriverManager.getConnection(DriverManager.java:664) at java.sql.DriverManager.getConnection(DriverManager.java:247)

Resolution

1. Please download the latest MySQL driver Connector/J from this official page: https://dev.mysql.com/downloads/connector/j/
2. Load the latest MySQL driver to the Talend Administration Center lib folder
   <TomcatPath>/webapps/org.talend.administrator/WEB-INF/lib 
3. Restart Talend Administraion Center application after adding the driver 

MySQL JDBC drivers are backward compatible.

Cause

As per MySQL documentation, the driver class name has been updated from com.mysql.jdbc.Driver (deprecated) to com.mysql.cj.jdbc.Driver and using the deprecated driver may cause compatibility or communication issues.

For more information, please refer to MySql official document:

https://dev.mysql.com/doc/connector-j/en/connector-j-api-changes.html

Related Content 

installing-external-modules-manually-for-tac

Environment

Talend Administration Center 

The following error is thrown when running an ETL task on a specific table in Qlik Compose:

ETL task aborted - Unexpected Primary Key violations detected in 'Table Name'.

Resolution

Enable Handle Duplicates on the problematic table.

Cause

Troubleshooting steps taken:

1. We identified that PK violation errors occurred on the staging table (TSTG). Compose checks for duplicate records in the staging table and raise this error when duplicates are found.
2. In the DWH ETL process, Qlik Compose loads data from landing tables (both full load and CDC) into staging tables before transferring it to DWH tables. As part of this process, Qlik Compose also checks for duplicates in the staging table.
3. After reviewing the table mappings, we observed that lookups are defined for certain columns in the problematic table. Additionally, based on the task statements, the staging table population logic includes a join between the landing table and lookup tables to retrieve data for the lookup columns.

If the lookup tables contain duplicate records, the query will insert those duplicates into the staging table, leading to the PK violation errors.

Environment

• Qlik Compose

When opening the Table Selection option in the Designer tab or clicking the Test Connection button for an endpoint, the following error may appear:

Error: SYS-E-HTTPFAIL, SYS-E-UNRECREQPARM, Unrecognized request parameter 'action'.. SYS,GENERAL_EXCEPTION,SYS-E-UNRECREQPARM, Unrecognized request parameter 'action'.,SYS,UNRECOGNIZED_REQUEST_PARAMETER,action

Resolution

Restart the Qlik Enterprise Manager service.

Cause

Qlik Enterprise Manager API calls are not processing parameters correctly.

Environment

• Qlik Replicate

When the Use direct path full load option is in use for an Oracle as a target endpoint, some integrity constraints are automatically disabled and will be recreated after the Full Load, such as Indexes.

Failure to create the Indexes will result in the following error message in your task log once CDC replication starts and the task attempts to use the index:

[TARGET_APPLY    ]E:  ORA-01502: index 'Schema.Table' or partition of such index is in unusable state  [1020436]  (oracle_endpoint_bulk.c:893)

Resolution

Identify the root cause of the Index creation failure with your Oracle DBA. This particular scenario failed to create the Index as the Oracle DB did not have enough temp table space to create the Index on the large tables.

The issue was resolved by increasing the temp table space used for the Index creation to unlimited.

Cause

The Oracle target Database did not have enough temp table space to complete the Index creation for the table.

Internal Investigation ID(s)

SUPPORT-693

Environment

• Qlik Replicate

• header_change_oper is a Qlik header from Qlik change tables to log the operation of the CDC event. (Delete, Update, Insert)
• Operation_indicator function is a transformation that can be applied as a new column to act as a soft delete function. Soft deletes will prevent a delete operation from deleting the record. Instead of deleting the record, the record is updated with the desired value of your choosing in the new column added.
• operation_indicator (value_on_delete, value_on_update, value_on_insert)
  When the operation_indicator function is in use, deletes will no longer apply, meaning the header_change_oper values will also reflect the change. All Delete operations will be reflected as an Update operation. This behavior is by design.

Resolution

To achieve the default behavior where a delete gets a 'D' value for header_change_operation,  remove the Operation_indicator function from your transformation.

See the headers and functions documentation for details:

• Qlik Headers Documentation 
• Qlik Functions Documentation 

Environment

• Qlik Replicate

Replicating data from Oracle, where the data type is `RAW` (such as  C6B578B216B05B2555541FBD6BF1B216B046B00B25), casting the `RAW` data to a `STRING` results in the value being stored with a `0x` prefix (such as: 0xC6B578B216B05B2555541FBD6BF1B216B046B00B25).

Transformations to remove the `0x` prefix specifically will not work. The Hex function should be applied to the column to remove the `0x` prefix.

Resolution

The '0x' prefix is added by the AWS S3 reader. To resolve this, modify the transformation process in Qlik Replicate by applying the hex function when converting to a string. On the column's expression builder, add hex($Column_Name) where Column_Name is the name of your Raw datatype column.

Cause

AWS S3 reader converts the Raw datatypes with additional prefixes due to how the Binary data is processed.

Internal Investigation ID(s)

RECOB-9409

Environment

• Qlik Replicate

In Qlik Sense, bookmarks can be created with the "Include Layout State" option to capture both current selections and the layout of visual objects, such as the expanded or collapsed state of pivot tables. However, users may notice that after reloading the document and reapplying the bookmark, the pivot table does not return to the expected expanded/collapsed layout.

Resolution

To ensure that the pivot table layout is retained when using bookmarks:

• Avoid changing the structure of the pivot table after creating the bookmark.
• Ensure that dimension value order remains consistent in the data source to prevent layout mismatch.
• If changes to dimension order or pivot structure are necessary, consider creating new bookmarks to reflect the updated layout.

Cause

This behavior is due to how Qlik Sense manages the expand/collapse structure in pivot tables. Specifically:

• Qlik Sense relies on the data load order of dimension values to track and restore the expand/collapse state.
• If the order of values in a dimension changes in the source data, the original layout state stored in the bookmark becomes invalid.
• When the pivot table structure changes (e.g., dimensions are reordered, added, or removed), Qlik Sense considers it a new layout, and the previously saved layout state can no longer be applied.

Impact of Changing Dimensions in a Pivot Table

If you change the pivot table structure after creating a bookmark (such as removing or reordering dimensions):

• Qlik Sense treats this as a different visual object layout.
• The bookmark will still apply filter selections but not the layout state.
• The expand/collapse configuration of the pivot will not be restored.

Environment

• Qlik Sense Enterprise on Windows all versions
• Qlik Cloud Analytics

You may encounter error that pax web server could not started from talend runtime side with the following error in log

2025-04-10T16:32:33,598 | ERROR | paxweb-config-1-thread-1 (change controller) | x.web.service.internal.Activator 623 | 227 - org.ops4j.pax.web.pax-web-runtime - 9.99.0 | Unable to start Pax Web server: Cannot recover key java.security.UnrecoverableKeyException: Cannot recover key at sun.security.provider.KeyProtector.recover(KeyProtector.java:304) ~[?:?]

Resolution

Please adapt the following variables (password) to  runtime/etc/custom.properties accordingly

TESB_TLS_KEYSTORE_PASSWORD=password
TESB_TLS_KEY_PASSWORD=password

Cause

Based on

keytool -v -list -keystore xxx

checking, the TESB_TLS_KEYSTORE_PASSWORD and TESB_TLS_KEY_PASSWORD are not setting correctly in  custom.properties file which caused the issue : java.security.UnrecoverableKeyException: Cannot recover key

org.ops4j.pax.web.cfg
org.ops4j.pax.web.ssl.password=${env:TESB_TLS_KEYSTORE_PASSWORD:-${TESB_TLS_KEYSTORE_PASSWORD}}
org.ops4j.pax.web.ssl.keypassword=${env:TESB_TLS_KEY_PASSWORD:-${TESB_TLS_KEY_PASSWORD}}

Related Content 

If you are looking for how you can configure your Talend ESB Container to be able to encrypt and decrypt your security properties, please refer to beblow documentation from Help site

enabling-password-encryption

Environment

Talend ESB 

When publishing a DI Job to TMC, if the artifact has been migrated and was previously an OSGI bundle, TMC may display the artifact in question as a "Data Service". However, when viewing the Job in question, there may be no “Job Type” selection in the “Job/Deployment” tab; and all commands were left in DI mode, if using CICD.

[INFO] RelativePath: process
[INFO] StartingDir: /var/lib/jenkins/workspace/<Repo Name>/<project name>/process
[INFO] DefaultContext: QA
[INFO] JobType: data_service
[INFO] Git author: , Id: , Date: null, Project: BBW_OSGI, Branch: null
[INFO] Artifact id: <artifact name>
[INFO] Artifact groupId:
[INFO] The latest published version is: null
[INFO] Publish version: 0.1.0
[INFO] Environment: rpooyadev-env1; workspace: testing-tasks; owner: rpooya
[INFO] Publishing process: /var/lib/jenkins/workspace/<Repo Name>/<project name>/poms/jobs/process/<iten name>/target/<artifact name>.zip
[INFO] UpdateFlow: false

Cause

This has been confirmed to be due to a change that automatically detects the "Build Type" (when an ESB component, such as RESTClient, is present) rather than requiring it to be selected for a DI Standalone Job.

Regarding the items in question, they may have been saved or exported during a time when an ESB component was included, which would explain the presence of the line "<additionalProperties xmi:id="_AVcasO-mEe-T64JJ_U4MkQ" key="BUILD_TYPE" value="OSGI"/>" in the ".properties" file.

Resolution

Internal Investigation ID(s)

Support-2172

Environment

• Talend Data Integration 8.0.1