article How to allow Anonymous Hub access in Qlik Sense Enterprise on Windows in Official Support Articles

How to allow Anonymous Hub access in Qlik Sense Enterprise on Windows

Sonja_Bauernfeind — Thu, 11 Aug 2022 10:13:32 GMT

Three requirements need to be met in order to allow Anonymous users access to the Hub:

The product must not be Qlik Sense Business or Qlik Sense Enterprise SaaS.
The license must support anonymous access, see Which Qlik Sense Enterprise licenses support anonymous access?
Proxy must be configured to allow Anonymous users
A Stream dedicated to anonymous users must be created

Useful information:

Users who access Qlik Sense anonymously are identified as NONE\anonymousd9e61933-a7e5-4836-8540-5b137a600e69, where the GUID is a unique identifier.
To create a license rule, granting login passes to anonymous users you can use two identifiers:
- userDirectory=NONE
- user.IsAnonymous()

Configure the Proxy to allow Anonymous users

By default, anonymous access is disabled. The steps provided require a restart of the Proxy service after completion.

Open the Qlik Sense Management Console.
Choose the Virtual Proxy to be used for anonymous access
Click Edit.
In the Properties menu (right side) choose Authentication
From the Anonymous access mode drop-down select Allow anonymous users

Set up a license rule

Anonymous users will need to have a license rule available for them which gives them either an Analyzer Capacity License or a Login Access Token. The instructions in this article will focus on Analyzter Capacity Licenses.

Open the Qlik Sense Management Console.
Navigate to License Management
Click Analyzer capacity rules
Click Create new
Give the new rule a Name (mandatory) and Description (optional)
Create one of two possible rules:
1. In the Basic settings, select
  user: userDirectory =
  value: NONE
2. In the Advanced settings (see Fig 2), provide the condition:
  user.IsAnonymous()
  
  Fig 2
Click Apply

Set up a Stream for anonymous access

You can use the default Everyone stream, which has already been set up for anonymous access, or create your own.

We will create two rules. One to allow logged in (authenticated) users access and publishing permissions. One to allow anonymous user access, but no publishing permissons. Note that based on your requirements, this may need to modified.

Go to the Qlik Sense Management Console
Go to Manage Content and Streams
Click Create New
Name your new Stream
Click Security Rules
Click Create associated rule (see Fig 2)
This will be our "Everyone (anonymous) can read the stream." rule.

Fig 3
Provide a Name (mandator) and Description (optional)
In Basic only select Read
In Advanced define
Condition: user.IsAnonymous()
Context: Only in hub

See Fig 4.

Fig 4
Click Apply
Click Create associated rule (see Fig 2)
This will be our "Everyone (logged in) can access this stream and publish." rule.
Provide a Name (mandator) and Description (optional)
In Basic only select Read and Publish.
In Advanced define
Condition: !user.IsAnonymous()
Context: Both in hub and QMC
Click Apply

Test!

We are now ready to test access.

Go to the Qlik Sense Hub (hosted by the Virtual Proxy you have configured)
If you are logged in, log out.
Our new Anonymous stream is now avaiable.

Re: How to allow Anonymous Hub access in Qlik Sense Enterprise on Windows

RaviGinqo — Wed, 19 May 2021 19:32:40 GMT

Hi Sonja,

Thanks for the article, I also wanted to know what will be session timeout for Anonymous users. Can session Monitor give correct details for session analysis of anonymous users?

Is the session inactivity timeout on Virtual proxy applicable to anonymous users as well?

Ravi

Re: How to allow Anonymous Hub access in Qlik Sense Enterprise on Windows

Sonja_Bauernfeind — Thu, 20 May 2021 06:33:53 GMT

Hello @RaviGinqo!

The same timeout applies for all users, regardless of whether or not they are logged in - and all sessions are recorded in the Session Monitor.

-Sonja

Re: How to allow Anonymous Hub access in Qlik Sense Enterprise on Windows

ilyas393 — Fri, 03 Sep 2021 00:29:43 GMT

Hi Sonja,

Thanks for the helpful article.

Is it possible to have the same proxy (basically the same URL) for non-anonymous and anonymous users?

Right now, we have qlik.company.com for the hub. And users are basically SSO in. They can directly access the hub and the apps if they have access to.

We now have an app that everyone at the organization should be able to access. Ours is a huge organization, and we don't have like a huge AD group with everyone in it. So, the other option is to enable the anonymous user ability so that anybody can access the portal.

When we enable ALLOW ANONYMOUS users, all the users land on the everyone stream, and users who have access to other streams are having to click on the LOG IN button to sign in. So basically non-anonymous users have an extra step to click on the LOG IN button.

Is it possible that all non-anonymous users can see the streams they have access to and anonymous users see only the everyone stream, using the same URL, and no extra clicking for the non-anonymous users?

Sorry if my post is confusion. Just want to get an idea if this is even possible?

I understand the other solution will be to create a virtual proxy for the anonymous users, but then we would end up having two URL's; one of anonymous and other for non-anonymous.

Appreciate your thoughts.

Thanks,

Ilyas

Re: How to allow Anonymous Hub access in Qlik Sense Enterprise on Windows

Sonja_Bauernfeind — Mon, 13 Sep 2021 12:06:44 GMT

Hello @ilyas393

Either way, a user will need to authenticate somehow. You may be able to build something with a single sign-on solution that will automatically login a user and then provide them seamless access to all the apps they have available, but even then there would need to have to be some trigger or button-click as how else would you make the decision between "I am going to log in" or "I am anonymous".

It might be worth dropping this question over in our forums to see if anyone has tailored a solution like that to their needs.

All the best,

Sonja

Re: How to allow Anonymous Hub access in Qlik Sense Enterprise on Windows

ilyas393 — Mon, 13 Sep 2021 12:12:59 GMT

Hi Sonja,

Thanks for your response. I ended up removing the filters from the UDC and allowing everyone at our organization to access the application, opened up just the EVERYONE stream and locked other streams with specific AD Groups. This seemed to solve our requirement.

Thanks,

Ilyas

Re: How to allow Anonymous Hub access in Qlik Sense Enterprise on Windows

Sonja_Bauernfeind — Mon, 13 Sep 2021 12:14:34 GMT

@ilyas393 That's a great use of streams and AD Groups!

Thank you for taking the time to leave the comment - I am sure other customers will find this useful.

-Sonja

Re: How to allow Anonymous Hub access in Qlik Sense Enterprise on Windows

Mccutchan1 — Tue, 07 Dec 2021 21:12:57 GMT

Hi Sonja,

It looks like each user is identified as NONE\anonymous. Are there any logs in Qlik Sense or any other way to track who is access the application via anonymous access?

Thanks

McCutchan

Re: How to allow Anonymous Hub access in Qlik Sense Enterprise on Windows

Sonja_Bauernfeind — Wed, 08 Dec 2021 13:48:27 GMT

Hello @Mccutchan1

This depends on where the users are coming from and if you have access to logs as well as if you have any means to identify them based on IP address. Sense will no be able to ID them for you, but you can fetch the IP address out of this log:

Directory: C:\ProgramData\Qlik\Sense\Log\Proxy\Trace
File: QLIKSERVER3_Audit_Proxy

This is what a simplified example looks like (I stripped out some columns and dropped them into an Excel file):

Additional info can be fed into the logs if you enable Enhanced Security, but again, nothing that will help you ID the user directly. The IP address in the proxy log is your best bet.

All the best,

Sonja

Re: How to allow Anonymous Hub access in Qlik Sense Enterprise on Windows

Mccutchan1 — Wed, 08 Dec 2021 16:20:16 GMT

Thank you for the information Sonja!

Re: How to allow Anonymous Hub access in Qlik Sense Enterprise on Windows

Mccutchan1 — Thu, 09 Dec 2021 20:36:44 GMT

Hi Sonja,

We are planning on sending out an URL for the anonymous access application. Once the application is accessed is there anyway to hide the menu from being seen?

Re: How to allow Anonymous Hub access in Qlik Sense Enterprise on Windows

Sonja_Bauernfeind — Thu, 16 Dec 2021 09:18:17 GMT

Hello @Mccutchan1

This is as of now not adviseable. See Disabling Navigation and Menu button after publishing the application in Qlik Sense is not advisable and feasible.

If you are looking to hide all aspects of the Sense hub navigation, maybe a mashup would suit your needs better?

All the best
Sonja

Re: How to allow Anonymous Hub access in Qlik Sense Enterprise on Windows

Mccutchan1 — Mon, 03 Jan 2022 21:14:35 GMT

Hi Sonja,

I followed the document above but still seems to be having a few issues. The server set up is a central node, proxy node, 2 reloading nodes and 2 viewer nodes. The only way I can get the anonymous access to work is if I go to the proxy node and change the authentication to allow anonymous access. The problem is that links that individuals have been using are getting an error message

If I change the Authentication back to no anonymous users then the links work but my link for anonymous access does not work. I did notice that the virtual proxy I set up is not a "default virtual proxy". Any idea how to solve the issue?

Thanks

Re: How to allow Anonymous Hub access in Qlik Sense Enterprise on Windows

Sonja_Bauernfeind — Wed, 12 Jan 2022 12:33:30 GMT

Hello @Mccutchan1

Based on the message you are receiving, the anonymous access attempt cannot be assigned a required access pass.

Please verify that you have the correct license type that supports anonymous access (so either Analyzer Capacity Licenses or Login Access Tokens) and that your license assignment has been set up correctly.

Should that not help, I'd recommend either to posting this over in our community forum (Deployment and Management ) or logging a Support ticket (as log files may need to be reviewed).

All the best,
Sonja

Re: How to allow Anonymous Hub access in Qlik Sense Enterprise on Windows

Mccutchan1 — Mon, 07 Mar 2022 14:52:07 GMT

Hi @Sonja_Bauernfeind ,

We are trying to use anonymous access so that we do not have to place everyone in a AD group. At the same time we want to track who is coming into the app. We are trying to use an iFrame to accomplish this. Have you had any experience in doing this?

Re: How to allow Anonymous Hub access in Qlik Sense Enterprise on Windows

Sonja_Bauernfeind — Wed, 09 Mar 2022 10:11:59 GMT

Hello @Mccutchan1

I think I need to give the same answer to this as I have done previously: Since you would be using anonymous access, meaning the user does not send identifying information, you would need to use a different piece of software to help you figure out who is coming in. What Sense will be able to give you is the IP address. You'd then need to match this IP address or other identifiers to track them.

I am not familiar with your use case though; so what you are trying to accomplish at large. I would suggest posting in our forums and outlining what you are trying to achieve (including how you are currently attempting to do so). Our users and support agents might have additional input for you that I cannot provide you in this article.

The correct forum is: Integration, Extension & APIs.

Re: How to allow Anonymous Hub access in Qlik Sense Enterprise on Windows

dsuarezseidor — Tue, 09 Aug 2022 16:32:31 GMT

Thank you very much for the explanation.

I get to the Test without problems, but when I try to open any APP from that Stream it tells me that I don't have permissions to access QlikSense.

What should I do to be able to access the Apps?

Re: How to allow Anonymous Hub access in Qlik Sense Enterprise on Windows

Sonja_Bauernfeind — Thu, 11 Aug 2022 10:15:38 GMT

Hello @dsuarezseidor

If you've gone through all the required steps (verified your license supports it, set up the proxy for anonymous access, created a license rule to support it), then you should be good with this article.

What is the exact error message you are receiving?

All the best,
Sonja

Re: How to allow Anonymous Hub access in Qlik Sense Enterprise on Windows

dsuarezseidor — Thu, 11 Aug 2022 14:07:02 GMT

Thanks for de answer Sonja.

I did a review of topic so I think I can't access the Apps with Anonymous user, because we don't have Analyzer Capacity License. We only have Professional or Analizer user.

Thanks!
David S.

Re: How to allow Anonymous Hub access in Qlik Sense Enterprise on Windows

Sonja_Bauernfeind — Thu, 11 Aug 2022 14:12:31 GMT

You are correct, a capacity license would be needed.