topic OIDC 400 Bad Request Contact your system administrator. The user cannot be authenticated or logged out by the OIDC response through the following virt in Integration, Extension & APIs

OIDC 400 Bad Request Contact your system administrator. The user cannot be authenticated or logged out by the OIDC response through the following virt

PREMinQLIK_DBS2 — Mon, 27 May 2024 07:15:10 GMT

Hi Qlikers,
Thanks for your time for looking into this. I have a question regarding MFA using OIDC for Qliksense Enterprise windows , it will be helpfull anyone have faced this issue before and solved.
We had recently configured OIDC MFA setup , so below are the stages for authentcation
1. User will open the link : https://<qliksenseserver>/auth2
2. the page will redirect to MFA (company MFA authentication).
3. then it redirect to Redirect URL : https://<qliksenseserver>/auth2/oidcauthn and hub will be displayed.

But in above 3rd step is not working after 2nd step authentication(MFA). giving error :"400
Bad Request
Contact your system administrator. The user cannot be authenticated or logged out by the OIDC response through the following virtual proxy: auth2"

from some community link had also added realm in Virtual proxy setting, but still showing above error.

Re: OIDC 400 Bad Request Contact your system administrator. The user cannot be authenticated or logged out by the OIDC response through the following

Marc — Tue, 28 May 2024 01:31:18 GMT

The HostAllow list has a bunch of values that all start with https://<qliksenseserver>/

for the url https://sense.domain.tld

I would use either sense.domain.tld or domain.tld in the headers.

Failing to set these values correctly will result in the error 400

Also ensure that you have linked the Virtual Proxy to the Proxy Service that will be serving it

Re: OIDC 400 Bad Request Contact your system administrator. The user cannot be authenticated or logged out by the OIDC response through the following

PREMinQLIK_DBS2 — Thu, 30 May 2024 15:16:02 GMT

Hi @Marc, Thanks for your reply. I tried this but it still failed... i saw in url something Auth_level=1&requiredAuthlevel=2,

any OIDC attributes we need to supply ?.