article HTTP protocol error 401 Monitoring Apps or other app reloads fails with Kerberos Authentication in Qlik Sense Enterprise on Windows in Official Support Articles

HTTP protocol error 401 Monitoring Apps or other app reloads fails with Kerberos Authentication in Qlik Sense Enterprise on Windows

Anonymous — Wed, 14 Sep 2022 10:38:56 GMT

If Kerberos Authentication is used in Qlik Sense then the following error can be observed:

Error: QVX_UNEXPECTED_END_OF_DATA: HTTP protocol error 401 (Unauthorized).

Kerberos Authentication is not supported with REST Connector. The only workaround is not to use Kerberos Authentication.

In addition, the License and Operation Monitoring Apps will not reload anymore if using Kerberos. When trying to Reload them, the following error is observed:

Error: QVX_UNEXPECTED_END_OF_DATA: HTTP protocol error 401 (Unauthorized):
'Negotiate' authentication schema provided by the web-service is not supported or your credentials are not valid.

The reload of monitoring apps fails if Kerberos Authentication is enabled. The Kerberos authentication is not currently supported by the REST connector.

Resolution

You have two options on how to address this. Either you swap to JWT Authentication for the Monitoring Apps or disable Kerberos entirely.

To swap to JWT Authentication, see Qlik Sense: Modify REST connections for Monitoring Apps to use JWT authentication.

To disable Kerberos instead:

In the Qlik Sense Management Console, open the Proxy (Central) and choose edit.
With the Ports Properties visible, disable Kerberos authentication - See Fig 1

Fig 1

Environment:

Re: HTTP protocol error 401 Monitoring Apps or other app reloads fails with Kerberos Authentication in Qlik Sense Enterprise on Windows

jaishree_Qlik — Wed, 13 Oct 2021 12:57:36 GMT

Hi,

I have tried implementing this solution and able to run the hub modifying hub URL as : https://localhost/jwt/hub/my/work , but when trying to modify Data Connections for monitoring apps its using jwt , reload task fails due to failed Server connection error.

Re: HTTP protocol error 401 Monitoring Apps or other app reloads fails with Kerberos Authentication in Qlik Sense Enterprise on Windows

Sonja_Bauernfeind — Thu, 14 Oct 2021 14:13:03 GMT

Hello @jaishree_Qlik

Did you follow the instructions in Qlik Sense: Modify REST connections for Monitoring Apps to use JWT authentication? If all the instructions were followed as documented, I would recommend posting about this issue in our forums to make use of our active community and support agents monitoring it. The correct forum would be Connectivity & Data Prep.

Re: HTTP protocol error 401 Monitoring Apps or other app reloads fails with Kerberos Authentication in Qlik Sense Enterprise on Windows

alexey_kozlov — Thu, 13 Jan 2022 12:09:17 GMT

Hello.

This is currently under investigation by R&D for future enhancement.

Any news about this?

Thank you advance

Re: HTTP protocol error 401 Monitoring Apps or other app reloads fails with Kerberos Authentication in Qlik Sense Enterprise on Windows

Sonja_Bauernfeind — Thu, 21 Apr 2022 13:01:21 GMT

Hello @alexey_kozlov

I've reviewed our internal doc for this and we have no short terms plan for introducing Kerberos support for the REST connector. I would recommend to vote for this idea: Kerberos authentication fully working (so also with rest/monitoring connections).

I've updated this article.

All the best,
Sonja

Re: HTTP protocol error 401 Monitoring Apps or other app reloads fails with Kerberos Authentication in Qlik Sense Enterprise on Windows

diagonjope — Wed, 31 Aug 2022 16:47:12 GMT

Hi @Sonja_Bauernfeind ,

Is it possible to set up a Virtual Proxy that does not use Kerberos using a linked Proxy that is configured to use Kerberos?

I am asking because we are running into a situation at a customer site using Kerberos. The customer has a very constrained and controlled vSphere environment where they don't want to create new VMs, but they also want to monitor the usage of their QSEoW platform using the monitoring applications.

I am trying to avoid creating a new Proxy node VM. So, I need to find out if one could use their existing Proxy, configured to use Kerberos, with an additional Virtual Proxy configured to use just JWT authentication (for the monitoring apps).

Please advise.

Cheers,

+José

Re: HTTP protocol error 401 Monitoring Apps or other app reloads fails with Kerberos Authentication in Qlik Sense Enterprise on Windows

Sonja_Bauernfeind — Thu, 01 Sep 2022 09:47:54 GMT

Hello @diagonjope

If you use the workaround described here: Qlik Sense: Modify REST connections for Monitoring Apps to use JWT authentication you will not need a new Proxy, only a new Virtual Proxy.

Hope this helps!

If you need assistance setting this up, I'd recommend posting directly in our forums about it so that you can make use of our active community.

All the best,
Sonja

Re: HTTP protocol error 401 Monitoring Apps or other app reloads fails with Kerberos Authentication in Qlik Sense Enterprise on Windows

diagonjope — Thu, 01 Sep 2022 14:14:26 GMT

Thank you @Sonja_Bauernfeind for your response.

The reason I asked is because, in the case described above in this page, it seems to require disabling Kerberos authentication at the existing Proxy level. So, I wanted to make sure that the workaround proposed, using JWT authentication in a new Virtual Proxy, will work when using a linked Proxy that still has enabled Kerberos authentication.

Furthermore, if we follow the instructions above and disable Kerberos at the Proxy level, will the existing Virtual Proxy configured for Kerberos continue to work as usual?

In any case, we'll give it a shot and see what happens.

Cheers,

++José

Re: HTTP protocol error 401 Monitoring Apps or other app reloads fails with Kerberos Authentication in Qlik Sense Enterprise on Windows

Sonja_Bauernfeind — Thu, 01 Sep 2022 14:19:28 GMT

Hmmm, that is a very good point. Let me verify this for you, @diagonjope. I was under the impression it is either or.

Re: HTTP protocol error 401 Monitoring Apps or other app reloads fails with Kerberos Authentication in Qlik Sense Enterprise on Windows

Sonja_Bauernfeind — Fri, 02 Sep 2022 07:13:12 GMT

Hello @diagonjope

You don't need to disable Kerberos if you use the JWT authentication.

All the best,
Sonja

Re: HTTP protocol error 401 Monitoring Apps or other app reloads fails with Kerberos Authentication in Qlik Sense Enterprise on Windows

diagonjope — Tue, 13 Sep 2022 13:45:53 GMT

Hi @Sonja_Bauernfeind !

Just a brief note to let you know that we have a new virtual proxy with JWT enabled working with the instructions provided above (with the exception of disabling Kerberos in the Proxy) and it works fine: the Monitoring Apps are reloading without any problems.

In view of this, I suggest that the requirement to disable Kerberos that appears in the article should be revised/ eliminated, since it may throw off other people as well.

Cheers,

++José

Re: HTTP protocol error 401 Monitoring Apps or other app reloads fails with Kerberos Authentication in Qlik Sense Enterprise on Windows

Sonja_Bauernfeind — Wed, 14 Sep 2022 10:40:20 GMT

Hello @diagonjope

Thank you for confirming!

I've clarified the article a little and hope that the new phrasing will prevent confusion in the future. And, thank you again! Your feedback and your raising this was very valuable.

All the best,
Sonja

Re: HTTP protocol error 401 Monitoring Apps or other app reloads fails with Kerberos Authentication in Qlik Sense Enterprise on Windows

diagonjope — Wed, 14 Sep 2022 15:11:02 GMT

Thank you @Sonja_Bauernfeind to you and the rest of the Qlik Support team for all your timely responses to issues like this.

Cheers,

++José