How to allow Anonymous Hub access in Qlik Sense Enterprise on Windows

[Sonja_Bauernfeind]

Three requirements need to be met in order to allow Anonymous users access to the Hub:

• The product must not be Qlik Sense Business or Qlik Sense Enterprise SaaS.
• The license must support anonymous access, see Which Qlik Sense Enterprise licenses support anonymous access?
• Proxy must be configured to allow Anonymous users
• A Stream dedicated to anonymous users must be created 

Useful information:

• Users who access Qlik Sense anonymously are identified as NONE\anonymousd9e61933-a7e5-4836-8540-5b137a600e69, where the GUID is a unique identifier.
• To create a license rule, granting login passes to anonymous users you can use two identifiers:
  • userDirectory=NONE 
  • user.IsAnonymous()

Configure the Proxy to allow Anonymous users

By default, anonymous access is disabled. The steps provided require a restart of the Proxy service after completion. 

1. Open the Qlik Sense Management Console.
2. Choose the Virtual Proxy to be used for anonymous access
3. Click Edit.
4. In the Properties menu (right side) choose Authentication
5. From the Anonymous access mode drop-down select Allow anonymous users
   
   
   
   

Set up a license rule 

Anonymous users will need to have a license rule available for them which gives them either an Analyzer Capacity License or a Login Access Token. The instructions in this article will focus on Analyzter Capacity Licenses. 

1. Open the Qlik Sense Management Console.
2. Navigate to License Management 
3. Click Analyzer capacity rules 
4. Click Create new 
5. Give the new rule a Name (mandatory) and Description (optional) 
6. Create one of two possible rules:
   1. In the Basic settings, select
      user: userDirectory =
      value: NONE
      
   2. In the Advanced settings (see Fig 2), provide the condition:
      user.IsAnonymous()
      
      Fig 2

       

7. Click Apply

Set up a Stream for anonymous access

You can use the default Everyone stream, which has already been set up for anonymous access, or create your own. 

We will create two rules. One to allow logged in (authenticated) users access and publishing permissions. One to allow anonymous user access, but no publishing permissons. Note that based on your requirements, this may need to modified. 

1. Go to the Qlik Sense Management Console
2. Go to Manage Content and Streams
3. Click Create New
4. Name your new Stream
5. Click Security Rules 
6. Click Create associated rule (see Fig 2) 
   This will be our "Everyone (anonymous) can read the stream." rule.
   
   Fig 3
7. Provide a Name (mandator) and Description (optional) 
8. In Basic only select Read 
9. In Advanced define
   Condition: user.IsAnonymous()
   Context: Only in hub
   
   See Fig 4. 
   
   Fig 4

    

10. Click Apply 
11. Click Create associated rule (see Fig 2)
    This will be our "Everyone (logged in) can access this stream and publish." rule.
12. Provide a Name (mandator) and Description (optional) 
13. In Basic only select Read and Publish.
14. In Advanced define
    Condition: !user.IsAnonymous()
    Context: Both in hub and QMC
15. Click Apply

Test!

We are now ready to test access. 

1. Go to the Qlik Sense Hub (hosted by the Virtual Proxy you have configured)
2. If you are logged in, log out.
   
   
   
   
3. Our new Anonymous stream is now avaiable.

[Sonja_Bauernfeind]

Hello @Mccutchan1 

This is as of now not adviseable. See Disabling Navigation and Menu button after publishing the application in Qlik Sense is not advisable... 

If you are looking to hide all aspects of the Sense hub navigation, maybe a mashup would suit your needs better?

All the best
Sonja

[Mccutchan1]

Hi Sonja,

I followed the document above but still seems to be having a few issues. The server set up is a central node, proxy node, 2 reloading nodes and 2 viewer nodes. The only way I can get the anonymous access to work is if I go to the proxy node and change the authentication to allow anonymous access. The problem is that links that individuals have been using are getting an error message 

If I change the Authentication back to no anonymous users then the links work but my link for anonymous access does not work. I did notice that the virtual proxy I set up is not a "default virtual proxy". Any idea how to solve the issue?

Thanks

[Sonja_Bauernfeind]

Hello @Mccutchan1 

Based on the message you are receiving, the anonymous access attempt cannot be assigned a required access pass.

Please verify that you have the correct license type that supports anonymous access (so either Analyzer Capacity Licenses or Login Access Tokens) and that your license assignment has been set up correctly. 

Should that not help, I'd recommend either to posting this over in our community forum (Deployment and Management ) or logging a Support ticket (as log files may need to be reviewed).

All the best,
Sonja 

[Mccutchan1]

Hi @Sonja_Bauernfeind ,

We are trying to use anonymous access so that we do not have to place everyone in a AD group. At the same time we want to track who is coming into the app. We are trying to use an iFrame to accomplish this. Have you had any experience in doing this? 

[Sonja_Bauernfeind]

Hello @Mccutchan1 

I think I need to give the same answer to this as I have done previously: Since you would be using anonymous access, meaning the user does not send identifying information, you would need to use a different piece of software to help you figure out who is coming in. What Sense will be able to give you is the IP address. You'd then need to match this IP address or other identifiers to track them.

I am not familiar with your use case though; so what you are trying to accomplish at large. I would suggest posting in our forums and outlining what you are trying to achieve (including how you are currently attempting to do so). Our users and support agents might have additional input for you that I cannot provide you in this article.

The correct forum is:  Integration, Extension & APIs.

[dsuarezseidor]

Thank you very much for the explanation.

I get to the Test without problems, but when I try to open any APP from that Stream it tells me that I don't have permissions to access QlikSense.

What should I do to be able to access the Apps?

[Sonja_Bauernfeind]

Hello @dsuarezseidor 

If you've gone through all the required steps (verified your license supports it, set up the proxy for anonymous access, created a license rule to support it), then you should be good with this article.

What is the exact error message you are receiving?

All the best,
Sonja 

[dsuarezseidor]

Thanks for de answer Sonja.

I did a review of topic so I think I can't access the Apps with Anonymous user, because we don't have Analyzer Capacity License. We only have Professional or Analizer user. 

Thanks!
David S.

[Sonja_Bauernfeind]

You are correct, a capacity license would be needed.

[msabi]

Hello @Sonja_Bauernfeind 
I followed Same instructions that you wrote,and I'm able to see the stream without login but I got error when i try to open the app:( 

kindly check this image: