MFA via DuoMobile

[atakacs]

Hello

We would like to implement MFA to our on-premise QlikSense server. Our users are in a "classic" Windows AD directory, Qlik runs on a dedicated Windows server and we would like to use DuoMobile as our authenticator.

I'm pretty sure it can be done but I have not found a specific procedure. Any pointer most welcome.

[Albert_Candelario · Accepted solution]

Hello @atakacs,

The authentication is not done at Qlik Sense level, is only communicating to it via the different protocols, SAML, OIDC, NTLM...

If that software can be connected to your Active Directory then it should work, otherwise you might need to use an IdP that works with both that software and Qlik Sense via its different protocols.

For example, I can have Qlik Sense working with Auth0 and having the MFA enabled on Auth0.

Cheers,

Albert

[atakacs]

Thanks for your prompt answer.

I am not really versed into the architecture of Qlik Sense but as far as I can see the user facing GUI runs within it's own bundled HTTP server, and said server is doing the authentication against our AD.

Again I have not done the setup but are you implying there is some middleware involved ? Sorry if it sounds like a newbie question...

[atakacs]

I am "reopening" this subject as I still don't have any concrete solution.

I understand that Qlik Sense is actually delegating the authentication to a "third party" and it is up to said external library / system to bring up the various user / pass prompt, including triggering a Duo authentication.

Would any kind soul point me to an actual solution to achieve this (= "use product X" or "library Y will do it") ? Obviously I'd rather use publicly available tools but if needs be happy to purchase something.

[Albert_Candelario]

Hello @atakacs,

Are you still looking for a MFA with your AD or do you consider other options, like using an IdP like Auth0 or AzureAD to connect to Qlik Sense using the OIDC protocol and enable the MFA on AzureAD or Auth0?

Cheers,

Albert