Skip to main content
Announcements
SYSTEM MAINTENANCE: Thurs., Sept. 19, 1 AM ET, Platform will be unavailable for approx. 60 minutes.
cancel
Showing results for 
Search instead for 
Did you mean: 
inhalesulfur
Contributor
Contributor

Qlik Sense WebSocket timeouts in IBM WebSEAL integration via Virtual Proxy

Hi!

We supporting Qlik Sense Enterprise in Sberbank of Russia.

Almost all our Qlik Sense installations (those with more than 50 users) integrated with IBM Security Manager for managing access to streams, apps and etc.

Our customers authenticate through Virtual Proxy with IBM WebSEAL used as reverse-proxy and they facing regular disconnections due to connection timeout.

We found the reason for this timeouts:

Qlik Sense can use several WebSocket connections in one browser page, and some of them can be inactive if user don't use related parts of app.

WebSEAL closes this connections cuz of inactivity timeout, and this leads to error in Qlik Sense. 

Common case:

When you creating new app, two WebSocket connections are up, first for Analysis tab, second for Data tab.

WebSEAL handle each WebSocket connection with its own inactivity timeout, and if you, for example, write load script for 30 minutes (time depends on WebSEAL config), the first WebSocket will be closed by WebSEAL due to inactivity and Qlik Sense will show error and force you to reload page. 

Our case:

We use Qlik Sense Mashup with many objects integrated from different apps via Qlik Sense API. Each app has its own WebSocket connection, and if at least one app will be inactive for a while, its WebSocket will be closed by WebSEAL. This leads to the same error, that forced our customers to reload browser page and lose the app state.

I posted this issue on IBM community (link)

In this post I would like to know is it possible to resolve this issue on Qlik Sense side.

Posible solutions:

1) Implement WebSocket warming

When at least one connection receives message, broadcast ping-message for all opened connections. This will refresh WebSEAL inactivity timeout for each WebSocket.

I attached our solution (sudir-timeout.js), but it works only in Mashups, in HUB timeouts are still an issue.

And this solutions badly affects WebSEAL, cuz it allocates thread for each WebSocket connection, so inactive connections will consume threads for no reason.

2) Implement WebSocket reconnection

If connection is lost for some reason, Qlik Sense should make attempt to reconnect then needed

 

I hope you can help us with this issue.

Also attached some screenshots.

1) error dialog

2) Network trace from Chrome DevTools

We opened app, did not open Data tab, work only in Analysis for 10 minutes and WS connection for Data tab was closed by WebSEAL (it was configurated with 10 minutes WS timeout), Qlik Sense showed error dialog and asked to reload page.

 

1 Reply
inhalesulfur
Contributor
Contributor
Author

I got answer from IBM that our issue can not be resolved on WebSEAL side:

https://community.ibm.com/community/user/security/communities/community-home/digestviewer/viewthread...