Qlik Sense for Windows: How to configure OIDC with Keycloak

[Damien_Villaret]

This is a guide on how to configure a virtual proxy with OIDC authentication in Qlik Sense for Windows with Keycloak as the Identity Provider.

The steps in the article are detailing that needs to be changed based on the default configuration which was tested with Keycloak 13.0.0.0

Environments:

Qlik Sense Enterprise on Windows May 2021 and later

Resolution

Keycloak

In "Clients", create a new client

Set the Access Type to "confidential"

Add a valid Redirect URI, this should be: https://<name-of-qliksense-server>/<virtual-proxy-prefix>/oidcauthn

Save.

The Client configuration in Keycloak is now done. We now need to copy the following as they are needed for the Qlik Sense virtual proxy configuration.

Copy the OpenID endpoint URL:

Copy the secret:

Qlik Sense

Create a new virtual proxy in the QMC, configure the virtual proxy as usual (Engine load balancing, host white list, associate to Proxy service) and for the authentication part choose OIDC and configure like below:

The fields to pay attention to are the following:

OpenID Connect metadata URI: (can be found from Realm settings in Keycloak)

Client ID: (This is the name of the client created in Keycloak)

Client secret: (can be found in the client settings in Keycloak)

scope: openid email profile

[annabelg]

Good Afternoon @Damien_Villaret 🙂 

Is there a way how to get some Client Scopes (defined for a user) from Keycloak and store them on QlikSense ? E.G. like group or roles ?

thanks in advance!

[Charvick]

Hi @Damien_Villaret 

I've integrated keycloak with Qliksense for authentication. I followed the steps from you post Qlik Sense for Windows: How to configure OIDC with... - Qlik Community - 1812463 and configured a virtual proxy in Qliksense and also the same in Keycloak as well, I am able to get to the required keycloak page using the keycloak virtual proxy in the URL but even after I enter the credentials into the keycloak page, Qlik is still prompting me to enter my username and password. Is there any way I could configure it so that just entering my credentials in to the keycloak page will directly take me to my app?

Note: I am able to open hub and few apps in the hub. But I am unable to access the mashups for few of my apps

Thanks in advance

[Sonja_Bauernfeind]

Hello @Charvick please post about your query and the issues you are facing directly in our Integration forum, where they will be exposed to our larger userbase and active support agents.

All the best,
Sonja 

[Charvick]

I posted it in the Integration forum. Thanks @Sonja_Bauernfeind