https://community.qlik.com/t5/Suggest-an-Idea/Increase-safety-and-decrease-admin-work-for-JWT-identity/idi-p/1891903 <P>Currently it is easy to configure JWT as an identity provider in Qlik SaaS but there is a major security flaw: there is no built-in way to restrict the JWT payload so basically whoever has the JWT certificate gets full tenant admin access.</P> <P>The fix for this would be simple: when configuring JWT identity provider, just add a text field for specifying the user domain and another for entering Group whitelist so only JWT payloads that specify a matching group value, and the user account belongs to the specified group. At its simplestm the whitelist could be just one value and support wildcards e.g. '*customer_*' but of course it would be better to support multiple value whitelists.</P> <P>Why this matters:</P> <UL> <LI>Safety is a key concern when organizations move to the cloud. Current JWT setup easily leads to a major security risk and just one bad incident with a high profile customer can tarnish the reputation of Qlik SaaS.</LI> <LI>Embedding and integrating with 3rd party systems is central to "active intelligence", and JWT plays a major role when cooperating with customers and suppliers. Such cooperation will also help promote Qlik to potential new customers.</LI> <LI>Although it is possible to circumvent this security flaw by setting up a "JWT proxy" ie. not expose Qlik SaaS JWT itself but external parties would only see a custom middle-man JTW service that includes group whitelists etc. This requires setting up a new service which is never a simple task in a corporate environment, and will require additional admin and maintenance for handling additional certificates etc. Ease of setup and management is a key driver for SaaS adoption so this again would undermine it.</LI> </UL> <P>One argument I've heard for not needing restrictions is that if you support JWT then you just need to anyway trust that it is used responsibly, or using a car analogy: if you let someone borrow your car, you just have to trust that they obey traffic laws. I think this argument is flawed: I might be willing to give someone my car keys but why should I be forced to also give my house keys at the same time? There should be an easy way to unbundle my keys.</P> <P>And yes, as a Qlik partner, we're facing multiple real customer cases that are hindered by this issue.</P> Fri, 11 Feb 2022 10:36:21 GMT fukicubiq 2022-02-11T10:36:21Z https://community.qlik.com/t5/Suggest-an-Idea/Increase-safety-and-decrease-admin-work-for-JWT-identity/idi-p/1891903 <P>Currently it is easy to configure JWT as an identity provider in Qlik SaaS but there is a major security flaw: there is no built-in way to restrict the JWT payload so basically whoever has the JWT certificate gets full tenant admin access.</P> <P>The fix for this would be simple: when configuring JWT identity provider, just add a text field for specifying the user domain and another for entering Group whitelist so only JWT payloads that specify a matching group value, and the user account belongs to the specified group. At its simplestm the whitelist could be just one value and support wildcards e.g. '*customer_*' but of course it would be better to support multiple value whitelists.</P> <P>Why this matters:</P> <UL> <LI>Safety is a key concern when organizations move to the cloud. Current JWT setup easily leads to a major security risk and just one bad incident with a high profile customer can tarnish the reputation of Qlik SaaS.</LI> <LI>Embedding and integrating with 3rd party systems is central to "active intelligence", and JWT plays a major role when cooperating with customers and suppliers. Such cooperation will also help promote Qlik to potential new customers.</LI> <LI>Although it is possible to circumvent this security flaw by setting up a "JWT proxy" ie. not expose Qlik SaaS JWT itself but external parties would only see a custom middle-man JTW service that includes group whitelists etc. This requires setting up a new service which is never a simple task in a corporate environment, and will require additional admin and maintenance for handling additional certificates etc. Ease of setup and management is a key driver for SaaS adoption so this again would undermine it.</LI> </UL> <P>One argument I've heard for not needing restrictions is that if you support JWT then you just need to anyway trust that it is used responsibly, or using a car analogy: if you let someone borrow your car, you just have to trust that they obey traffic laws. I think this argument is flawed: I might be willing to give someone my car keys but why should I be forced to also give my house keys at the same time? There should be an easy way to unbundle my keys.</P> <P>And yes, as a Qlik partner, we're facing multiple real customer cases that are hindered by this issue.</P> Fri, 11 Feb 2022 10:36:21 GMT https://community.qlik.com/t5/Suggest-an-Idea/Increase-safety-and-decrease-admin-work-for-JWT-identity/idi-p/1891903 fukicubiq 2022-02-11T10:36:21Z https://community.qlik.com/t5/Suggest-an-Idea/Increase-safety-and-decrease-admin-work-for-JWT-identity/idc-p/2100515#M13774 <P>From now on, please track this idea from the Ideation portal.&nbsp;</P><P><STRONG><A title="Link to new idea" href="https://ideation.qlik.com/app/#/case/281744" target="_blank" rel="noopener">Link to new idea</A></STRONG></P><P>Meghann</P><P data-unlink="true"><EM>NOTE: Upon clicking this link 2 tabs may open - please feel free to close the one with a login page. If you <STRONG>only</STRONG> see 1 tab with the login page, please try clicking this link first: <STRONG><A title="Authenticate me!" href="#" target="_blank" rel="noopener">Authenticate me!</A></STRONG>&nbsp;t</EM><EM>hen try the link above again. Ensure pop-up blocker is off.</EM></P> Wed, 02 Aug 2023 15:38:19 GMT https://community.qlik.com/t5/Suggest-an-Idea/Increase-safety-and-decrease-admin-work-for-JWT-identity/idc-p/2100515#M13774 Meghann_MacDonald 2023-08-02T15:38:19Z https://community.qlik.com/t5/Suggest-an-Idea/Increase-safety-and-decrease-admin-work-for-JWT-identity/idc-p/2100516#M13775 Wed, 02 Aug 2023 15:38:21 GMT https://community.qlik.com/t5/Suggest-an-Idea/Increase-safety-and-decrease-admin-work-for-JWT-identity/idc-p/2100516#M13775 Ideation 2023-08-02T15:38:21Z