topic Error 400 when logging with OIDC through Keycloak in Integration, Extension & APIs

Error 400 when logging with OIDC through Keycloak

morenoju — Mon, 04 Apr 2022 18:10:00 GMT

Hi all,

I've configured OIDC with Keycloak for my Qlik Sense for Windows as per this article:

https://community.qlik.com/t5/Knowledge/Qlik-Sense-for-Windows-How-to-configure-OIDC-with-Keycloak/ta-p/1812463

However, after using my credentials I get an Error 400 Bad Request Contact your system administrator. The user cannot be authenticated or logged out by the OIDC response through the following virtual proxy: keycloak.

I've looked at the Audit_Proxy log in C:\ProgramData\Qlik\Sense\Log\Proxy\Trace and I see:

15161 20220404T175230.536+0000 WARN azure-qlik-demo Audit.Proxy.Proxy.SessionEstablishment.Authentication.OIDC.OidcAuthenticationHandler 131 378d8f51-28eb-48d6-822f-34bfd9135556 azure-qlik-demo\QlikServices Proxy.SessionEstablishment.Authentication.OIDC.OidcAttributeParserException: Exception of type 'Proxy.SessionEstablishment.Authentication.OIDC.OidcAttributeParserException' was thrown.↵↓ at Proxy.SessionEstablishment.Authentication.OIDC.OidcAttributeParser.ParseUserDirectory(JwtPayload jwtPayload, String subjectAttributeField, String realm)↵↓ at Proxy.SessionEstablishment.Authentication.OIDC.OidcAuthenticationHandler.<GetAuthenticatedUser>d__11.MoveNext() 0 862b90b5-0828-486a-8c3a-89434bc4caaf ::ffff:172.19.7.98 {keycloak} 043edfe1d2021b49bf6392980199db57289764d0

This message is very similar to the one described in https://community.qlik.com/t5/Knowledge/Qlik-Sense-How-to-request-an-OIDC-token-manually-and-check-if/ta-p/1843408, but in that thread the issue was related to having mandatory attributes in the Virtual Proxy configuration in QMC. In my configuration I don't have any OIDC attribute mapping.

Any idea of what might be failing?

Thanks

Re: Error 400 when logging with OIDC through Keycloak

annabelg — Tue, 19 Apr 2022 07:23:57 GMT

Good morning,

Did you solve the issue by any chance, as I am having the same issue ?

Re: Error 400 when logging with OIDC through Keycloak

morenoju — Tue, 19 Apr 2022 12:19:12 GMT

Yes, I found a way to solve it. This is what I did:

I set the realm name in the Qlik Sense Virtual Proxy. It is marked as optional, but I added it nevertheless. I also inserted the client secret again. I got a new error this time "Proxy unable to load balance any of the engine services".

I added "central" as load balancer for the Qlik Sense keycloak Virtual Proxy and tried again. This time I was able to log in with my Keycloak user.

I hope it helps.

Re: Error 400 when logging with OIDC through Keycloak

Micky123 — Fri, 21 Apr 2023 03:30:54 GMT

hey @morenoju i am having problem configuring keycloak integration with qliksense can you send me what all steps you did other than this https://community.qlik.com/t5/Official-Support-Articles/Qlik-Sense-for-Windows-How-to-configure-OIDC-with-Keycloak/ta-p/1812463.