topic Re: Qlik Sense Authentication - Java in Integration, Extension & APIs

Qlik Sense Authentication - Java

Fri, 01 Apr 2016 18:43:09 GMT

I am trying to develop a Java application which uses the Engine APIs to get all the apps and related data.

So far I have found that Qlik Sense has only NTLM or Kerberos as built in authentication mechanisms and the server needs to be connected to an external authentication module which authenticates the users. Please let me know if I have got this wrong.

Also, I have read that Qlik Sense will accept users authenticated against other systems. And then using the Ticket API or the Session module or the Header mode to access the Sense system. How does Qlik Sense know whom to trust? How do I link an external authentication module to the server?

The following is the sequence that I want to implement: authenticate -> get all apps data (please suggest if I can achieve this using REST APIs exposed or if I need to use web sockets and engine apis) -> use this information in our platform.

It would be very helpful if somebody can post a sample authentication sequence using the QPS or any other service which can be implemented without using the .NET SDK. A small concrete example would be super helpful.

Lastly, is it possible to do a simple straightforward authentication using REST APIs and using other APIs. Is there any other way to get the Apps list? Please advice.

Thanks,

Nikhil

Re: Qlik Sense Authentication - Java

Alexander_Thor — Fri, 01 Apr 2016 19:13:29 GMT

Yes, Qlik don't have users in that manner. We can do NTML or Kerberos as we ship a LDAP user connector out of the box so we can pass through authentication in that manner. For other types of authentication you would use the QPS API to either issue tickets to users or pass on a existing session into Qlik.

All of this is enabled through certificate trust. Qlik Sense generates certificates for it's services and you can export certificates from QMC. So if your service signs the requests with the certificates, we will trust you. We will also trust that you have authenticated your users when you request a ticket or pass on a session.

However since it sounded like you are going to be parsing a large number of apps in a short time frame you will be hit by the 5 session limit imposed on user authentication. Instead I would recommend you open a websocket channel directly to the engine wss://<server>:4747/app/<enginesession> and supply a X-Qlik-User header that specifies a service user. That will allow you to bypass the 5 session limit and if you sign your requests using the certificates there is no need to authenticate as we trust the signed requests.

This is a example in javascript of how to connect directly to the Engine using websockets

QES-NoProxy-Certs.js · GitHub

There are no REST endpoints available if you wish to interact with the application so you would use the Engine API to do that.

Re: Qlik Sense Authentication - Java

Alexander_Thor — Fri, 01 Apr 2016 19:16:32 GMT

Just as a follow-up, if you are just looking to access the raw data that resides in a Qlik app you can dump tables to CSV files during script reload execution using the STORE loadscript command.

That will most likely be faster then send potentially massive amounts of data over the socket and you don't have to burden your Qlik server with having to load all apps into memory.

If you are looking at leveraging Qlik's on-demand calculation and aggregation engine, then yes you would use the Engine API.

Re: Qlik Sense Authentication - Java

Fri, 01 Apr 2016 20:02:28 GMT

For exporting the certificate, could you please let me know what the machine name should be? I mean, what should be used as the machine name?

Thanks,

Nikhil

Re: Qlik Sense Authentication - Java

Fri, 01 Apr 2016 20:20:48 GMT

Its up to you, however, in our project we've specified the name as the application entry domain, but that pure preference.

Re: Qlik Sense Authentication - Java

jp_golay — Tue, 05 Apr 2016 23:43:16 GMT

Hi Alexander

Is it possible to authenticate using certificates and the .NET SDK

I see no way to include certificates in .NET Qlik Engine API?

Thanks JP

Re: Qlik Sense Authentication - Java

konrad_mattheis — Wed, 06 Apr 2016 07:40:18 GMT

see post: Re: .NET SDK Connect Using Certificates

Re: Qlik Sense Authentication - Java

Wed, 06 Apr 2016 16:26:47 GMT

We have decided that using Engine API with certificates based authentication is the way to go. I am trying to implement this using java-websocket library.

Thanks,

Nikhil

Re: Qlik Sense Authentication - Java

Thu, 07 Apr 2016 09:42:10 GMT

Hi Alexander,

I am trying to fetch the DocList from QES in C# as you explained.

Seems that the auth by certificate is working because my Response status is completed, but i'm getting 404 as http status.

I am attaching 2 sample test functions: Using HttpWebRequest and RestSharp. Both fail with the same message.

Do you have any idea about what I may be doing wrong?

EDIT: I have tried using websockets (websocket-sharp) but am still getting errors.

I have attached my test function and the stacktrace.

Any idea why the connection is failing? (seems to be the initial handshake)

Any clues where to look in the log files?

With thanks and regards,

Jessen

Re: Qlik Sense Authentication - Java

Wed, 13 Apr 2016 05:47:02 GMT

Hi Nikhil,

Have you been able to connect and interact with QES in Java? I have tried in c# but I cannot get it to work...

Thanks.

Re: Qlik Sense Authentication - Java

konrad_mattheis — Wed, 13 Apr 2016 13:36:21 GMT

Hi Jessen,

I can confirm you that the connection from JAVA is working.

We developed long time ago a project for a customer to connect

with JAVA to the Enginge & QMC and do a lot of fancy stuff.

bye Konrad

Re: Qlik Sense Authentication - Java

Wed, 13 Apr 2016 18:01:22 GMT

Hi Jessen,

Yes, I was able to connect using Java. I used NVWebSocket library for Java Web sockets. I had to import the certificates to a Java Keystore and use that to load the ssl context. One requirement is that your server url should have an entry in the proxy whitelist. I haven't tried much but I was able to call few global methods like getting the document list. Hope it helps.

The following examples helped: Java-WebSocket/SSLClientExample.java at master · TooTallNate/Java-WebSocket · GitHub

QES-NoProxy-Certs.js · GitHub

Thanks,

Nikhil

Re: Qlik Sense Authentication - Java

Anonymous — Wed, 08 Mar 2017 01:41:48 GMT

Hi Nikhil,

May i know how do you import the certificate (export from Qlik) to java keystore and use them in Java?

Basically I have tried the same example as you mentioned but for SSL socket i could never connect to "hostname:4747/api" with my java keystore while javascripts works fine to me.

Thank you.

Re: Qlik Sense Authentication - Java

StevenJDH — Mon, 23 Sep 2019 06:36:49 GMT

Hello all,

For those who are interested, I've created an updated example for how to request a ticket via Java. This version is more adaptable with a number of improvements and has better clarity. The biggest change is that you can now also use the standard certificates that are exported from Qlik Sense without having to convert them to the Java KeyStore (*.jks) format. You can find the code here: https://github.com/StevenJDH/Qlik-Sense-Java-Examples