Error 400 bad mapping with claims (Entra ID - OIDC)

[TatianaSLD]

Thanks to those other links in the Qlik community, I managed to configure the connection between Entra ID and Qlik Sense through OIDC :

- Qlik Sense for Windows: How to configure OIDC with... - Qlik Community - 1812401

- How To: Configure Qlik Sense Enterprise SaaS to us... - Qlik Community - 1704442

However, I still have a problem with claims. When I disable OIDC optional claims, I can login successfully, but when I add them back to have information about my users such as email or display name, I have an error 400.

Did someone manage to make it work ?

[Eduardo_Monteiro]

Hello @TatianaSLD 

Do you still need assistance?

Regards,

[TatianaSLD]

Hello @Eduardo_Monteiro ,

Yes I actually still need some help. Overall, in what I should provide on the Entra side to map correctly my claims.

Thank you !

[Eduardo_Monteiro]

Hi @TatianaSLD 

Are you using Qlik Sense Enterprise on Windows or Qlik Cloud?

Check the articles: 

Configure Qlik Sense Enterprise Client-Managed for Single sign-on with Microsoft Entra ID - Microsof...

How To: Configure Qlik Sense Enterprise SaaS to us... - Qlik Community - 1704442

For QSEoW we can check the logs to identify why it is failing. Those logs will probably show something like OIDC claim mapping failed: claim 'email' not found in token.

C:\ProgramData\Qlik\Sense\Log\Proxy\Trace\<hostname>_Proxy_Audit.log
C:\ProgramData\Qlik\Sense\Log\Proxy\System\<hostname>_Proxy_System.log

For Qlik Cloud you can also remove the extra claims to make sure you can successfully log in and try https://<tenantname>.us.qlikcloud.com/api/v1/diagnose-claims and check what is being mapped.

Please let me know the results.

Regards,

[TatianaSLD]

Dear @Eduardo_Monteiro ,

Thank you for your help !

However, I don't how or why, but OIDC is now working and I didn't touch anything neither my colleagues...

Have a good day !

Tatiana

[Eduardo_Monteiro]

Hi @TatianaSLD 

That's awesome! If you were testing it in Chrome, you might have been getting cached data.

I experienced it in the past. I always use 2 different browsers when working with idp.

BR,