Qlik Sense .NET SDK connection with NTLM via proxy

vlian

Hi team, I tried the sample code provided but still keep getting a 403 error when connecting to Qlik Sense.

I have tried with certificate, without certificate, with username/password and without them. I have Qlik Sense installed on my local and I can see the corresponding user in QMC. I've attached screenshot of the virtual proxy in case it's the virtual proxy configuration that is missing.

public List<IAppIdentifier> GetLocalQlikApps()
{
            var uri = new Uri("https://qlik-local.fraedom-dev.com:444");

            var location = Location.FromUri(uri);
            location.AsNtlmUserViaProxy(certificateValidation: false);

            using (var hub = location.Hub())
            {
                Console.WriteLine(hub.EngineVersion().ComponentVersion);
            }

            return null;
}

403 error screenshot:

Virtual Proxy screenshot:

For information the following CURL to the qrs works, so I would imagine the credentials would work.

curl -v -L --ntlm --negotiate -u : --insecure https://qlik-local.fraedom-dev.com:444/qrs/app?xrfkey=0123456789abcdef --header "x-qlik-xrfkey: 0123456789abcdef" --header "User-Agent: Windows"
* Host qlik-local.fraedom-dev.com:444 was resolved.
* IPv6: (none)
* IPv4: 127.0.0.1
*   Trying 127.0.0.1:444...
* schannel: disabled automatic use of client certificate
* ALPN: curl offers http/1.1
* ALPN: server did not agree on a protocol. Uses default.
* Connected to qlik-local.fraedom-dev.com (127.0.0.1) port 444
* using HTTP/1.x
> GET /qrs/app?xrfkey=0123456789abcdef HTTP/1.1
> Host: qlik-local.fraedom-dev.com:444
> Accept: */*
> x-qlik-xrfkey: 0123456789abcdef
> User-Agent: Windows
>
< HTTP/1.1 302 Authenticate at this location
< Cache-Control: no-cache, no-store, must-revalidate
< Location: https://qlik-local.fraedom-dev.com:444/internal_windows_authentication/?targetId=f274fac0-2157-45cc-a055-24ef4c0d49eb
< Content-Length: 0
< Access-Control-Allow-Origin: *
* Ignoring the response-body
* setting size while ignoring
<
* Connection #0 to host qlik-local.fraedom-dev.com left intact
* Issue another request to this URL: 'https://qlik-local.fraedom-dev.com:444/internal_windows_authentication/?targetId=f274fac0-2157-45cc-a055-24ef4c0d49eb'
* Re-using existing https: connection with host qlik-local.fraedom-dev.com
> GET /internal_windows_authentication/?targetId=f274fac0-2157-45cc-a055-24ef4c0d49eb HTTP/1.1
> Host: qlik-local.fraedom-dev.com:444
> Accept: */*
> x-qlik-xrfkey: 0123456789abcdef
> User-Agent: Windows
>
* Recv failure: Connection was aborted
* schannel: recv returned CURLE_RECV_ERROR
* Connection died, retrying a fresh connect (retry count: 1)
* Request completely sent off
* shutting down connection #0
* Issue another request to this URL: 'https://qlik-local.fraedom-dev.com:444/internal_windows_authentication/?targetId=f274fac0-2157-45cc-a055-24ef4c0d49eb'
* Hostname qlik-local.fraedom-dev.com was found in DNS cache
*   Trying 127.0.0.1:444...
* ALPN: curl offers http/1.1
* ALPN: server did not agree on a protocol. Uses default.
* Connected to qlik-local.fraedom-dev.com (127.0.0.1) port 444
* using HTTP/1.x
> GET /internal_windows_authentication/?targetId=f274fac0-2157-45cc-a055-24ef4c0d49eb HTTP/1.1
> Host: qlik-local.fraedom-dev.com:444
> Accept: */*
> x-qlik-xrfkey: 0123456789abcdef
> User-Agent: Windows
>
< HTTP/1.1 401 Unauthorized
< Content-Length: 0
< Server: Microsoft-HTTPAPI/2.0
< WWW-Authenticate: NTLM
< Date: Sun, 23 Nov 2025 22:11:18 GMT
< Access-Control-Allow-Origin: *
* Ignoring the response-body
* setting size while ignoring
<
* Connection #1 to host qlik-local.fraedom-dev.com left intact
* Issue another request to this URL: 'https://qlik-local.fraedom-dev.com:444/internal_windows_authentication/?targetId=f274fac0-2157-45cc-a055-24ef4c0d49eb'
* Re-using existing https: connection with host qlik-local.fraedom-dev.com
* Server auth using NTLM with user ''
> GET /internal_windows_authentication/?targetId=f274fac0-2157-45cc-a055-24ef4c0d49eb HTTP/1.1
> Host: qlik-local.fraedom-dev.com:444
> Authorization: NTLM TlRMTVNTUAABAAAAB7IIogQABAAyAAAACgAKACgAAAAKAF1YAAAAD1dXLUg5UVBKUjNWSVNB
> Accept: */*
> x-qlik-xrfkey: 0123456789abcdef
> User-Agent: Windows
>
< HTTP/1.1 401 Unauthorized
< Content-Length: 0
< Server: Microsoft-HTTPAPI/2.0
< WWW-Authenticate: NTLM TlRMTVNTUAACAAAACAAIADgAAAAFwomi7VgHIUdOK/Q6CwEAAAAAAI4AjgBAAAAACgBdWAAAAA9WAEkAUwBBAAIACABWAEkAUwBBAAEAFABXAFcALQBIADkAUQBQAEoAUgAzAAQAEAB2AGkAcwBhAC4AYwBvAG0AAwAmAFcAVwAtAEgAOQBRAFAASgBSADMALgB2AGkAcwBhAC4AYwBvAG0ABQAYAHYAaQBzAGEAYwBvAHIAcAAuAG4AZQB0AAcACAD/zjcYxlzcAQAAAAA=
< Date: Sun, 23 Nov 2025 22:11:18 GMT
< Access-Control-Allow-Origin: *
* Ignoring the response-body
* setting size while ignoring
<
* Connection #1 to host qlik-local.fraedom-dev.com left intact
* Issue another request to this URL: 'https://qlik-local.fraedom-dev.com:444/internal_windows_authentication/?targetId=f274fac0-2157-45cc-a055-24ef4c0d49eb'
* Re-using existing https: connection with host qlik-local.fraedom-dev.com
* Server auth using NTLM with user ''
> GET /internal_windows_authentication/?targetId=f274fac0-2157-45cc-a055-24ef4c0d49eb HTTP/1.1
> Host: qlik-local.fraedom-dev.com:444
> Authorization: NTLM TlRMTVNTUAADAAAAAAAAAFgAAAAAAAAAWAAAAAAAAABYAAAAAAAAAFgAAAAAAAAAWAAAAAAAAABYAAAABcKIogoAXVgAAAAPAu+wCaXtovyy19fdTJHawQ==
> Accept: */*
> x-qlik-xrfkey: 0123456789abcdef
> User-Agent: Windows
>
* Request completely sent off
< HTTP/1.1 302 Found
< Cache-Control: no-cache, no-store, must-revalidate
< Transfer-Encoding: chunked
< Location: https://qlik-local.fraedom-dev.com:444/qrs/app?xrfkey=0123456789abcdef&qlikTicket=HzqwuQf1VWkIdL.T
< Server: Microsoft-HTTPAPI/2.0
< Date: Sun, 23 Nov 2025 22:12:03 GMT
< Access-Control-Allow-Origin: *
* Ignoring the response-body
<
* Connection #1 to host qlik-local.fraedom-dev.com left intact
* Issue another request to this URL: 'https://qlik-local.fraedom-dev.com:444/qrs/app?xrfkey=0123456789abcdef&qlikTicket=HzqwuQf1VWkIdL.T'
* Re-using existing https: connection with host qlik-local.fraedom-dev.com
* Server auth using NTLM with user ''
> GET /qrs/app?xrfkey=0123456789abcdef&qlikTicket=HzqwuQf1VWkIdL.T HTTP/1.1
> Host: qlik-local.fraedom-dev.com:444
> Accept: */*
> x-qlik-xrfkey: 0123456789abcdef
> User-Agent: Windows
>
* Request completely sent off
< HTTP/1.1 200 OK
< Set-Cookie: X-Qlik-Session=85508311-952a-4cab-9951-a0cc951e5275; Path=/; HttpOnly
< Cache-Control: private, must-revalidate, max-age=0
< Transfer-Encoding: chunked
< Content-Type: application/json; charset=utf-8
< Expires: Sun, 23 Nov 2025 22:12:03 GMT
< Server: Microsoft-HTTPAPI/2.0
< Date: Sun, 23 Nov 2025 22:12:03 GMT
< Access-Control-Allow-Origin: *
<
[{"id":"cf506d27-5883-4fcd-92ef-6a23bacb369c","name":"CI_department_spend_6314bcf7-af8c-e911-8481-00155d67f500","appId":"","publishTime":"2023-12-19T03:29:36.922Z","published":true,"stream":{"id":"b4f08930-8be1-4c6f-adf1-cee895e0a7ac","name":"Insights User Apps","privileges":null}

Client Managed