topic PingFederate OIDC connection for Qlik Cloud in Management & Governance

PingFederate OIDC connection for Qlik Cloud

lupusyonderboy — Wed, 04 May 2022 21:39:54 GMT

I wanted to see if there is any type of documentation or if anyone here has successfully configured an OIDC connection in PingFederate that provides SSO to Qlik Cloud.

I have been trying to get my configuration to work but am currently stuck at a claims error everytime I try to validate the connection in Qlik. I know I am sending all the correct claims (open_id email sub profile) and am stuck at this point.

Any help from anyone would be greatly appreciated!!!

Re: PingFederate OIDC connection for Qlik Cloud

Seanog_Murphy — Thu, 05 May 2022 06:19:04 GMT

Hi @lupusyonderboy

Can you let me know what error you are getting?

You can check the claims being sent using the following API. Append the following to your Tenant URL as an authenticated user.
/api/v1/diagnose-claims

Re: PingFederate OIDC connection for Qlik Cloud

lupusyonderboy — Thu, 05 May 2022 16:20:26 GMT

This is the error I receive after I try to validate my connection. I get redirected back to my pingfed, login successfully and then when it tries to access Qlik I get this;

An error occurred while validating your identity provider configuration. Please review your configuration settings.

{
  "status": "claimsError",
  "oauth2Error": {
    "error": "invalid_client",
    "errorDescription": "Invalid client or client credentials."
  },
  "error": "Invalid client or client credentials."
}

Re: PingFederate OIDC connection for Qlik Cloud

alex_almero — Thu, 04 Aug 2022 19:07:13 GMT

verify the following in the OAuth Server settings:

1. an IdP adapter mapping to persistent grant.

2. access token management.

3. defined an access token mapping using the token manager defined above.

4. a policy manager.

5. ensure that you're using the client_id not the name in Qlik. Use the token manager and policy defined.

It would help if you can share the settings you have defined in PF. You should be able to test your configuration using Postman.