idea Re: Qlik Sense and NPrinting OnDemand extension and SSO using SAML auth in Suggest an Idea

Qlik Sense and NPrinting OnDemand extension and SSO using SAML auth

Zareh_T — Thu, 20 May 2021 11:54:43 GMT

It has been confirmed with Qlik that the OnDemand button only supports Windows NTLM authentication, that is when a user logs in to Qlik Sense via Windows, the OnDemand button then logs the user into NPrinting via Windows and the reports get generated immediately.

However, when a user is logged in to Qlik Sense via SAML authentication in Qlik Sense and NPrinting, The OnDemand button does not automatically authenticate the user into NPrinting and the report is not generated. This is where the problem is and this feature / process does not exist in the OnDemand button functionality yet.

Re: Qlik Sense and NPrinting OnDemand extension and SSO using SAML auth via OKTA

ericschmid — Wed, 01 Jul 2020 13:19:08 GMT

Thanks for this info - any thoughts on when this might be supported?

Re: Qlik Sense and NPrinting OnDemand extension and SSO using SAML auth via OKTA

millerhm — Wed, 01 Jul 2020 19:50:43 GMT

This also means that it's useless for OEM partners - our customers are obviously not on our Windows domain, so we have no ability to offer on demand reporting without SAML authentication.

Re: Qlik Sense and NPrinting OnDemand extension and SSO using SAML auth via OKTA - Status changed to: Open - Not Planned

Andrew_Kruger — Tue, 07 Jul 2020 17:55:19 GMT

This remains open in the backlog but there is not resolution planned to this at the moment.

Re: Qlik Sense and NPrinting OnDemand extension and SSO using SAML auth via OKTA

pabloviera — Tue, 22 Sep 2020 11:25:57 GMT

This is a must, we (And I guess more organizations each year) moved from NTLM to Google SSO and can't use the OnDemand Reports.

Re: Qlik Sense and NPrinting OnDemand extension and SSO using SAML auth via OKTA

mmatena — Thu, 26 Nov 2020 14:55:21 GMT

It would really be helpfull if this works, our organisation is moving towards a SAML authentication partner, so we cannot use the on-demand button anymore.

Re: Qlik Sense and NPrinting OnDemand extension and SSO using SAML auth via OKTA

vegard_bakke — Thu, 06 May 2021 15:15:57 GMT

@Zareh_T : Could you edit this suggestion to make it a bit more general? It applies to any SAML integration. Not just Okta. It applies to Okta, Azure AD, Auth0, Google SSO, the lot. 🙂

We have an increasing number of customers moving to Azure AD. And they are not happy when they realize that they suddenly lose their on-demand reports. Qlik is advertising NPrinting as "supporting SAML 2.0". First time I reported this, it was "fixed" by making the fine print a bit bigger.

I'm not sure how many from the sales team around the world know that NPritning doesn't support SAML. At least all of NPrinting doesn't. (Which almost makes it worse.)

Qlik can either wait for this problem to grow too large. Because it sure will grow. Or fix it sooner rather than later..

Re: Qlik Sense and NPrinting OnDemand extension and SSO using SAML auth via OKTA

vegard_bakke — Thu, 06 May 2021 15:22:21 GMT

And just for the record: If you do fix this for SAML users. Please include a way for the web ticket, JWT people to get correct section access when using on-demand as well. Don't strictly limit yourself to SAML.

Re: Qlik Sense and NPrinting OnDemand extension and SSO using SAML auth via OKTA

vegard_bakke — Fri, 07 May 2021 06:53:36 GMT

(Sorry. me again. : )

In the mean time. There might be a way around this. But it requires a bit of programming, and will not work for all usecases.

Copied from Qlik Parters Teams Chat:

here is a rough breakdown:

1) You need to make a web service, that can generate a JWT token *

2) You need a certificate that this module can use to sign the JWT token

3) You need to copy the public part of the certificate into NP JWT setup

4) You need a way to find the emailaddress (server-side) for the user (in my case the email is the Qlik userid, so I was lucky)

5) You need to modify the getLoginNtlm() function in the extension (like make a getLoginJwt()),

5a) This function needs to retrieve the JWT token from your web service (by passing on the session cookie, you can use Qlik Sense to verify who the user is)

5b) Having the JWT token, you request a (any?) API call from NPrinting server, and it will return a Nprinting session cookie

6) The Nprinting session cookie will follow any subsequent requests from the NP extension to NP server.

* NB! Never, ever, generate the JWT token based on information from the bowser only. HTTPS doesn't make the end-user a nice-guy. She can still send anything she like, just by pressing F12 in the browser. You can however, use the session cookie that is sent from the browser, and apply that to a server-to-server request to https://qlik.server.com/vproxy/qps/user. Then the Qlik server will reply with the actual username that "owns" that session.

So far, I have an unsolved problem: how to apply section access correctly. There might be a way to programmatically (or manually) add users with the field "domain name". Which apparently isn't a Windows NT domain name. Just a free text that gets passed to Qlik, so hopefully <userdirectory>\<userid> should work. (Creds to Damien Vilaret if this works. 🙂 )

Re: Qlik Sense and NPrinting OnDemand extension and SSO using SAML auth

hans_skjoethaug — Thu, 20 May 2021 15:30:14 GMT

This is an important feature since our on-demand users are not in out local AD

Re: Qlik Sense and NPrinting OnDemand extension and SSO using SAML auth

stiankarlsen — Fri, 21 May 2021 06:59:07 GMT

This should have been fixed years ago.

Re: Qlik Sense and NPrinting OnDemand extension and SSO using SAML auth

mattias — Fri, 21 May 2021 07:57:17 GMT

This is a very import feature for many customers.

Re: Qlik Sense and NPrinting OnDemand extension and SSO using SAML auth

KristofferD — Fri, 21 May 2021 10:08:02 GMT

This is an important feature. Qlik does not look very professional to the end users.

Re: Qlik Sense and NPrinting OnDemand extension and SSO using SAML auth

vegard_bakke — Fri, 21 May 2021 14:11:50 GMT

One more thing, when you decide to support on-demand reports for SAML (etc) users.

Please ensure that you include support for Sense apps with section access based on GROUP, and not just USERID!

The current implementation of NPritning does not reply user groups in request from NPrinting server to the Sense server. And section access rules that are based on GROUP will then give Access denied to users that normally are allowed to open the app, due to their group memberships.

(Maybe this is indirectly solved when Sense starts persisting attributes coming from ticket/JWT/SAML?)

Re: Qlik Sense and NPrinting OnDemand extension and SSO using SAML auth

Ken_B — Fri, 10 Sep 2021 08:03:39 GMT

This is crazy, we spotted no warning as we started down this path that this would happen. Qlik Sense supports SSO and nprinting is supposed to be an integrated part of the product suite. I'm also told that nprinting supports SAML for when a user wants to go to their newstand etc, but haven't tested that yet. But the basic ondemand printing doesn't.

This needs to move up the development priority!

Re: Qlik Sense and NPrinting OnDemand extension and SSO using SAML auth

ssapseid — Fri, 10 Sep 2021 12:58:08 GMT

We have the same issue at a customer running NPrinting on Demand and SAML SSO.

Is there any timeline for this to be looked at by Qlik?

Re: Qlik Sense and NPrinting OnDemand extension and SSO using SAML auth

KristofferD — Mon, 13 Sep 2021 06:06:37 GMT

We have the same issue. It is anything but userfriendly.

Re: Qlik Sense and NPrinting OnDemand extension and SSO using SAML auth

vegard_bakke — Mon, 11 Oct 2021 14:40:10 GMT

Apparently, www.qalyptus.com has now an on-demand reporting solution, that works with SAML SSO (i.e. Azure AD, etc).

https://www.linkedin.com/feed/update/urn:li:activity:6846436533357027328/

Vegard

Re: Qlik Sense and NPrinting OnDemand extension and SSO using SAML auth

jonas_viklund — Tue, 25 Jan 2022 10:01:12 GMT

Very good idea! We are using SAML auth in both sense and nprinting so we are not able to use on demand. Please fix this.

Re: Qlik Sense and NPrinting OnDemand extension and SSO using SAML auth

JHuis — Tue, 26 Apr 2022 11:25:40 GMT

+1,

this is necessary for using NPrinting in the QlikSense environment..

Can somebody tell if this is happening in the near future, because the start from this message is almost 2 years ago.