article Qlik Sense: Common error messages when using SAML in Official Support Articles

Qlik Sense: Common error messages when using SAML

Damien_V — Tue, 01 Feb 2022 09:18:56 GMT

This article gives an explanation of some of the common error messages.

Error 1:

Error 400 - Bad request

Contact your system administrator. The user cannot be authenticated by the SAML response through the following virtual proxy:

Error 2:

SAML mandatory attribute for user ID is missing

Error 3:

SAML assertion is expired

Error 4:

Error 500 - Internal server error

Internal server error

Error 5:

SAML assertion must be encrypted on an unsecured connection

Environment:

Error 400: Bad request

This is the most common error message that is encountered when using SAML. It basically means that the SAML request is malformed, missing some mandatory information, or we are encountering a time sync issue.

Missing Attribute:

The first step to take when this error appears is to check the Servername_Audit_Proxy.txt (C:\Programdata\Qlik\Sense\log\Proxy\Trace)

WARN QlikServer2 Audit.Proxy.Proxy.SessionEstablishment.Authentication.SAML.SamlAuthenticationHandler 47 82c8cc12-5bf4-42a5-af04-b8e2c64d5c50 DOMAIN\Administrator SAML mandatory attribute for user ID is missing 0

The error is sometimes obvious as in the above example. An attribute is missing.

The second step would be to look into the SAML response and see if the SAML attribute you have set for your user ID is in there:

Check if you have an element <saml:Attribute ... Name="Nameofyourattribute" > inside the <saml:AttributeStatement> element.

In this example, the attribute we were trying to use for the User ID is Email. We see that it is not present in the <saml:AttributeStatement> element.

Time sync issue:

Verify that the SAML request is not rejected because it is "expired" or "SAML assertion is expired" and also result in "400: Bad request". This can happen if for example an AWS server with Sense installed on it was not configured to automatically update its date/time settings. The time difference between the identity provider and Sense can then lead to the message being rejected.

In this case, adjust time settings accordingly.

Error 500: Internal Server error:

This can have different reasons but the troubleshooting process is similar to the example above.

In SAML, error 500 usually indicates an error with the certificate used. Either the certificate used is incorrect or does not have the proper Cryptographic Provider.

In order to use SHA-256 in Qlik Sense with SAML, the cryptographic provider for the certificate applied on the Qlik Sense proxy must be "Microsoft Enhanced RSA and AES Cryptographic Provider".
This limitation does not apply to the certificate used by the Identity provider.

The Servername_Audit_Proxy.txt (C:\Programdata\Qlik\Sense\log\Proxy\Trace) will either indicate "could not decrypt data" or an error with ComponentSpace.SAML2.Exceptions.SAMLSignatureException.

SAML assertion must be encrypted on an unsecured connection:

All network traffic has to be encrypted, that means it's mandatory to use the port 443 in order to have a secure connection.

Re: Qlik Sense: Common error messages when using SAML

Senor_Dai — Wed, 24 Nov 2021 20:05:12 GMT

Hi @Damien_V ,

I hope you can help.. Ive tried to implement SSO using Auth0 for QlikSense. SSO is working perfectly until I try to add user attributes. When I try to add SAML attributes to the qliksense proxy :

|

I get the Bad request 400 error when I try to login ...

Ive checked the logs (as you suggest) and it is saying there is a missing attribute :

But you can see from above Im trying to pass a 'groups' attribute.

This is the Auth0 Rule Script

And this is the Test User Metadata:

Id be so grateful if you could point out any mistakes in my configuration?

Many thanks

Dai

Re: Qlik Sense: Common error messages when using SAML

Damien_V — Wed, 24 Nov 2021 23:21:00 GMT

Hello @Senor_Dai

It's because you need to write the full name of the attribute "https://schemas.auth0.com/https://qlik;com/groups" in the virtual proxy settings, not just "groups" as this is how Auth0 sends it in the SAML response.

Re: Qlik Sense: Common error messages when using SAML

Senor_Dai — Thu, 25 Nov 2021 10:10:40 GMT

Hi @Damien_V ,

Thanks so much for taking the time to reply. Ive tried your suggestion :

Any thoughts as to why Im still getting the 400 Bad Request error?

Re: Qlik Sense: Common error messages when using SAML

Damien_V — Thu, 25 Nov 2021 10:13:38 GMT

Hello @Senor_Dai

Are you still getting exactly the same error in the Qlik Sense Proxy logs ?

Error 400 is just a generic error, you need to check the logs as you did before.

Re: Qlik Sense: Common error messages when using SAML

Damien_V — Thu, 25 Nov 2021 10:15:24 GMT

Actually when I look at it twice, the attribute name begins with http://, not https://

I would suggest you just copy the attribute name from the logs under "Existing attributes" to make sure it matches exactly.

Re: Qlik Sense: Common error messages when using SAML

Senor_Dai — Thu, 25 Nov 2021 10:56:57 GMT

Hi @Damien_V , Fantastic that allowed me to login...

Can you help further on how we 'pick up' the Group when our test user logs in? At the moment Im not seeing it against the user info:

Thanks once again

Re: Qlik Sense: Common error messages when using SAML

Damien_V — Thu, 25 Nov 2021 12:20:49 GMT

@Senor_Dai

In Qlik Sense August 2021 and earlier, optional SAML attributes are not persisted so they won't show up in the QMC (they're just available for the time of the session), but you can still create security rules on them by referencing them as "user.environment.groups" in a security rule.

See https://community.qlik.com/t5/Knowledge/Security-Rules-Fail-For-SSO-SAML-Users-and-The-Group-or-Other/ta-p/1715208

In Qlik Sense November 2021 and onwards, you have a checkbox in the virtual proxy settings that lets you decide if you want to persist or not those attributes. If you choose to persist them, then you will see it in the user info in the QMC, which makes it easier to audit.

Re: Qlik Sense: Common error messages when using SAML

Senor_Dai — Thu, 25 Nov 2021 13:38:49 GMT

Fantastic thanks again @Damien_V - your help has been invaluable!

Re: Qlik Sense: Common error messages when using SAML

Senor_Dai — Thu, 03 Feb 2022 11:08:40 GMT

Hi @Damien_V ,

We are using your solution to great success - so thanks so much!!

Could I ask another question on using Auth0 User Metadata and App Metadata? Could I also pass 'UserLevel' as an attribute so we can utilise both User Metadata and AppMetadata when logging in via Auth0 SSO?

Auth0 User Details:

Would we add another attribute for UserLevel in the virtual proxy :

Thanks again for your time.

Senor Dai

Re: Qlik Sense: Common error messages when using SAML

fsiviero — Thu, 12 May 2022 07:59:39 GMT

Hi @Damien_Villaret

I'm trying to find the checkbox in virtual proxy that lets you decide if you want to persist or not SAML attributes in user profile. I'm using February 2022 version

I didn't find any reference about this new feature in help pages.

Can you give me more information? thanks

Francesco

Re: Qlik Sense: Common error messages when using SAML

Damien_V — Thu, 12 May 2022 10:41:48 GMT

Hello @fsiviero

Sorry for the confusion. I double-checked internally and the checkbox is only there for OIDC authentication.

For SAML authentication, attributes will be persisted if you fill something in the "additional attribute mapping" section. If you leave that section blank, then attributes won't be persisted, but you can synchronize some from a User Directory Connector instead if you want.

Re: Qlik Sense: Common error messages when using SAML

BoB_Qlik_Support — Wed, 17 May 2023 07:36:47 GMT

Hello @Damien_V ,

Can SAML setup be done on RIM node (both load balancing and linked proxy ) or its mandatory to do it on central node.

Re: Qlik Sense: Common error messages when using SAML

BoB_Qlik_Support — Wed, 17 May 2023 07:37:11 GMT

Hello @Damien_V ,

Can SAML setup be done on RIM node (both load balancing and linked proxy ) or its mandatory to do it on central node.

Re: Qlik Sense: Common error messages when using SAML

Sonja_Bauernfeind — Wed, 24 May 2023 12:59:52 GMT

Hello @BoB_Qlik_Support

Rim and Central are both good to use.

All the best,
Sonja