topic Re: Wont User credentials stored in PGSQL get exposed? in Management & Governance

Wont User credentials stored in PGSQL get exposed?

AshwathRaj_26 — Sat, 16 Nov 2024 00:19:58 GMT

Hi,

My understanding is user credentials are stored in PGSQL which is used for validating login with external IdP

But if credentials are stored as-is in PGSQL wont they get exposed?

Re: Wont User credentials stored in PGSQL get exposed?

Anonymous — Thu, 01 Apr 2021 07:40:26 GMT

as per my knowledge no, user credentials (username and password) are not stored into postgreSQL.
The only credentials that are stored there are the ones of technical users used inside postgreSQL itself (see users postgresql and qliksenserepository).

For 'regular' end users, only a reference of their user directory ("domain", if you're working with active directory) and user id ("username", if you're working with active directory) are kept.
Once the IdP has verified your identity, will let you proceed to Qlik Sense. Only at this point the IdP will tell Qlik who you are (user directory + user id).

Let me know if this makes any sense for you

Riccardo

Re: Wont User credentials stored in PGSQL get exposed?

Levi_Turner — Thu, 01 Apr 2021 13:30:13 GMT

As @Anonymous mentioned, when doing authentication, Qlik Sense Enterprise neither stores nor really knows the credentials of the end user. Qlik Sense Enterprise leverages existing authentication systems (Active Directory, a SAML IdP, etc). Those systems evaluate the credentials (or usually a hash of the credentials, see https://security.stackexchange.com/questions/129832/understanding-ntlm-authentication-step-by-step) then send a token to Qlik Sense Enterprise signaling that a given user (domain\userId) has successfully authenticated.