Running Qlik Sense on Windows systems with FIPS compliance enabled

[Andre_Sostizzo]

Note: FIPS mode is not supported out of the box for Qlik Sense, QlikView, and Qlik NPrinting. Workarounds exist for NPrinting and Sense. For general information about FIPS and Microsoft's statement around it, see Microsoft's Security Guidance blog.

This guide will walk you through allowing Qlik Sense to run with FIPS enabled on the server.

Follow these steps:

1. Stop all Qlik Sense Services
2. Locate the directory where Qlik Sense is installed at (by default C:\Program Files\Qlik\Sense\)
3. In each service's folder (e.g. C:\Program Files\Qlik\Sense\Proxy\, ...Printing\, ...Repository\, ...Scheduler\), make a copy of that service's config file (e.g. C:\Program Files\Qlik\Sense\Proxy\Proxy.config)
   • Example C:\Program Files\Qlik\Sense\Proxy\Proxy.config_original  OR Proxy.exe.config  (depending on version)
4. Open Notepad as an Administrator
5. Open each service's config file in the Notepad window with elevated rights
6. Add to the <configuration>, <runtime> section of the configuration files below the parameter <enforceFIPSPolicy enabled="false"/>
   
   Example:
   
   

   <?xml version="1.0" encoding="utf-8"?>
   <configuration>
     <appSettings>
       <add key="SenseHome" value=""/>
     </appSettings>
   <startup><supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5.2"/></startup>
     <runtime>
       <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
         <dependentAssembly>
           <assemblyIdentity name="log4net" publicKeyToken="669e0ddf0bb1aa2a" culture="neutral"/>
           <bindingRedirect oldVersion="0.0.0.0-1.2.11.0" newVersion="1.2.11.0"/>
         </dependentAssembly>
       </assemblyBinding>
       <enforceFIPSPolicy enabled="false"/>
     </runtime>
   </configuration>

7. Save the file
8. Repeat for each service on the node (Printing, Proxy, Repository, Scheduler)
9. Repeat on each node in the multi-node deployment
10. Start services and validate that functionality works as expected

This change is needed in order for Qlik Sense and its .NET dependencies to not check whether FIPS is enabled. See https://msdn.microsoft.com/en-us/library/hh202806(v=vs.110).aspx

Note: Since you are modifying a file in %ProgramFiles%, do expect that this change will not persist after an upgrade. The general rule of thumb is that files in Program Files will potentially be modified by the installer whereas files in the ProgramData directory are not modified by the installer. So do remember this modification in case you need to re-apply it after an upgrade.

Related Content:

Qlik Software and FIPS mode