New data connection with OAuth - Error message "Code verification failed"

[vkal12]

Hello community,

we're using Qlik Sense Enterprise on-premises and have been trying to establish a data connection to DataBricks for some time. When authenticating with OAuth, we receive a verification code, but when we enter it and click "Verify," we receive the following error message: 

We have established a data connection to DataBricks via the DataBricks driver on our server. This worked with the same information but we would like to establish the data connection directly via the connector to authenticate users. 

Does anyone has an idea how we can fix this error message? When creating a connection for example with the Sharepoint Connector the verification with code works fine. 

Thank you very much in advance. 

Kind regards,
Vanessa

[dballing]

Try this:

Open a new browser window in Incognito mode and go to settings and clear all saved data in the browser, cookies, saved websites, saved usernames, etc. - all. 

Go to the Hub and create a new app and begin creating the Databricks connection again. 

When you get to the Azure Oauth authentication step, you will likely be prompted for your organanisations SSO login. Login and copy paste the authentication code again. Make sure the user creating the connection, authenticates via SSO is the same user as authorized to read the databases on Databricks.

Make sure SSL is enabled during the config of the data connection.

[vkal12]

Hello,

unfortunately I am not able to test it in the incognito mode because our Qlik Sense environment is only accessible from the internal company network. But I also tested your approach in a regular browser and didn't get any positive results. Authentication still fails.

I choose "Azure OAuth" as Authentication Mechanism and then enter my Tenant Id, Client Id and Client Secret from DataBricks. After I click on "Authenticate" I get redirected to https://connector.qlik.com where I can copy the authentication code to my clipboard. I copy it, enter it in the connector settings in the hub and then it shows me the following error message: 

SSL is enabled as well as proxy. 

[dballing]

Hi, Did you follow the approach of removing all browser data in your regular browser while doing this?

[vkal12]

Hi, yes I removed absolutely everything. I've just tried it with a different browser (Firefox) and then I get redirected to my organisations SSO login. After retrieving the authentication code I copy and paste it but I still get the same error message. 

[dballing]

OK thanks for confirming.

Are you able to retrieve log data for the latest unsuccessful connection attempts and paste any error indications here?

Additionally, while recreating the authentication step, can you open devl tools in your browser and check for any errors/warnings? Open one devl tools in each page so that errors will show in each of the two windows you are working in incl. when you are redirected to connector.qlik.com for authentication secret.

[vkal12]

Hi,

I have collected the log files (Locate the log files for ODBC connectors | Qlik Connectors Help) from this morning and can see the following ERROR messages: 

The serialization of the Cache threw an exception: Qlik.Connectors.SDK.Common.Exceptions.KeyProviderException: Could not get key with id prefix 'qseow' ---> System.FormatException: The input is not a valid Base-64 string as it contains a non-base 64 character, more than two padding characters, or an illegal character among the padding characters.      at System.Convert.FromBase64_Decode(Char* startInputPtr, Int32 inputLength, Byte* startDestPtr, Int32 destLength)     at System.Convert.FromBase64CharPtr(Char* inputPtr, Int32 inputLength)     at System.Convert.FromBase64String(String s)     at Qlik.Connectors.SDK.Common.Encryption.WindowsAesGcmEncryptionService.getKeyFromString(String keyStr)     at Qlik.Connectors.SDK.Common.Encryption.WindowsAesGcmEncryptionService.EncryptWithKey(String value, String inputKey)     at Qlik.Connectors.SDK.Common.Utilities.KeyProvider.KeyProvider.CreateKey(String keyFilePath)     at Qlik.Connectors.SDK.Common.Utilities.KeyProvider.KeyProvider.GetKeyInternal(Boolean autoCreate)     --- End of inner exception stack trace ---     at Qlik.Connectors.SDK.Common.Utilities.KeyProvider.KeyProvider.GetKeyInternal(Boolean autoCreate)     at Qlik.Connectors.SDK.Common.Services.FileSystemCaching.FileSystemCachingService.EncryptSecured(CacheItem item)     at Qlik.Connectors.SDK.Common.Services.FileSystemCaching.FileSystemCachingService.EncryptCacheDictionary()     at Qlik.Connectors.SDK.Common.Services.FileSystemCaching.FileSystemCachingService.Serialize()

Request state does not match

Error in HandleJsonRequest for method=getToken, exception=OAuthParametersException, error=Invalid request state, please re-authenticate, internalError=False

I just checked our ENCRYPTION_KEY and this key only contains big letters, small letters and numbers. No special characters. It contains 40 characters, no padding. Is this necessary? 

We also work with other build-in connectors (e.g. Office 365 Sharepoint) where the authentication with the authentication code works fine. 

[dballing · Accepted solution]

Log indicates issues with the encryption key. I would try to replace with a new key just in case.

More info on how to do this can be found here: https://help.qlik.com/en-US/connectors/Content/Connectors_Home/Setting-encryption-key.htm

Note: you'll likely have to recreate any other ODBC data connections made using the ODBC Data Connector Package, so make sure you have pass and credentials for existing connections at your disposal.

[vkal12]

Hi, 

we will replace the encryption key with a new one instead and try it again. I'll reply if it worked. 

[dballing]

Sounds good - while you are at it you might want to check Azure for any expired token secrets.