Deployment & Management

[AG-gugelbisolutions]

Hi there, I have always supposed Qlik Sense delegates authentication to the identity providers configured in the User Directory Connectors menu, but now I'm not that sure of it.

I recently deployed Qlik Sense on a virtual machine hosted by a cloud provider that is not part of the company's domain. I then configured the user directory connector (Active Directory) and was also able to download the full users list.

When trying to connect to the hub (https://localhost/hub), I get the login popup but authentication fails. Note that I'm using the same credentials I've used to configure the user directory connector in the previous step.

Windows logs some warnings that show that an authentication attempt was made and failed (Unknown user name or bad password). To me it seems like Qlik Sense is trying to perform authentication locally without engaging AD. In fact, we were not able to see any traffic generated by the login form submission.

Does this mean that Qlik Sense has to be installed on a machine that is part of the same domain as the users that try to  connect to it?

Is there a way to overcome this? Could it be the development of a custom login module?

Thanks

[Jay_Brown · Accepted solution]

Hello @AG-gugelbisolutions , you are correct.  It does need to be part of the same domain for AD or have a trust configured.

The best way to do this without configuring and enabling trust between the domains is to implement SAML Authentication with AD FS. 

https://help.qlik.com/en-US/sense-admin/November2021/Subsystems/DeployAdministerQSE/Content/Sense_De...

Hope this helps!

[AG-gugelbisolutions]

Hi @Jay_Brown and thanks. I have got an additional and different possibile solution to discuss, but I prefer to create a new thread.

I'll post the link asap.

Thanks

[AG-gugelbisolutions]

Here is the link to a new discussion where I try to describe what in my mind could represent a possible alternate solution.

https://community.qlik.com/t5/Deployment-Management/Multi-Node-Deployment-across-domains/m-p/1964723...

Is it feasible?