Unlock a world of possibilities! Login now and discover the exclusive benefits awaiting you.
Description:
This document explains the steps to configure the Qlik Sense Monitoring Applications (License Monitor, Operations Monitor, Etc) to use Certificate Authentication instead of default Windows Authentication.
Environment:
- Qlik Sense Enterprise on Windows # - All Version
The information in this article is provided as-is and to be used at own discretion. Depending on tool(s) used, customization(s), and/or other factors ongoing support on the solution below may not be provided by Qlik Support.
1. Export Qlik Certificates via the QMC
- Use the FQDN of the central node for Machine name
- Use Certificate Password
- Check the box to Include secret key
2. Navigate to the path listed to obtain the exported certificates:
- C:\ProgramData\Qlik\Sense\Repository\Exported Certificates
3. Copy the folder that was created and paste it into Engine folder of ALL nodes that will be used to reload the Monitoring Applications
- C:\ProgramData\Qlik\Sense\Engine\Certificates
4. Create a security rule that allows a user to access all Data Connections within the HUB
- Create rule from template = Data Connection Access
- Name = Data Connection Access
- Actions = Read / Update
- user --> name --> value = <userID>
4. Modify all REST Data Connections that are used by the Monitoring Apps. (e.g. monitor_apps_REST_app, monitor_apps_REST_appobject, monitor_apps_REST_xxxxxx, etc)
- Log into the HUB
- Open any application within your workspace to access the Data Load Editor
- Look for the Data Connections with the name monitor_apps_REST_xxxxxx
- Edit the Data Connection (Example monitor_apps_REST_app)
- URL = https://FQDNofCentralNode:4242/app/full
- Authentication Schema = Anonymous
- Certificate validation = Skip Server Certificate Validation
- Use certificate = From file
- PFX file name = <FQDN>\client.pfx
- PFX file password = (password used during export of certificates)
- Query Headers:
- Delete User-Agent = Windows
- Add X-Qlik-User = UserDirectory=INTERNAL; UserID=sa_api
- Test Connection and Save
- Log into QMC --> Data Connections --> Edit the Data Connection to remove the userID from the name.
- e.g: Change from monitor_apps_REST_app (domain_administrator) to monitor_apps_REST_app
- Repeat steps for all Data Connections with monitor_apps_REST_xxxxxx
5. Another way to update the rest of the data connections would be to modify them via the QMC
- Copy the Connection String from the one that was successfully updated via the HUB and paste into a notepad
- CUSTOM CONNECT TO "provider=QvRestConnector.exe;url=https://QlikServer1.domain.local:4242/qrs/app/full;timeout=999;method=GET;sendExpect100Continue=true;autoDetectResponseType=true;keyGenerationStrategy=0;authSchema=anonymous;skipServerCertificateValidation=true;useCertificate=FromFile;certificateStoreLocation=LocalMachine;certificateStoreName=My;certificateFilePath=QlikServer1.domain.local\client.pfx;trustedLocations=qrs_proxy%2https://localhost:4244;queryParameters=xrfkey%20000000000000000;addMissingQueryParametersToFinalRequ... %%userid%%2sa_api;PaginationType=None;"
- Copy the Connection String from one that still needs to be updated and paste into a notepad
- (monitor_apps_REST_appobject)
- CUSTOM CONNECT TO "provider=QvRestConnector.exe;url=https://localhost/qrs/app/object/full;timeout=900;method=GET;autoDetectResponseType=true;keyGenerationStrategy=0;authSchema=ntlm;skipServerCertificateValidation=true;useCertificate=No;certificateStoreLocation=LocalMachine;certificateStoreName=My;trustedLocations=qrs-proxy%2https://localhost:4244;queryParameters=xrfkey%20000000000000000;addMissingQueryParametersToFinalRequ...;"
- Update the next connection string with all of the information from the first one, BUT using the correct URL and paste into the Data Connection
- CUSTOM CONNECT TO "provider=QvRestConnector.exe;url=https://QlikServer1.domain.local:4242/qrs/app/object/full;timeout=999;method=GET;sendExpect100Continue=true;autoDetectResponseType=true;keyGenerationStrategy=0;authSchema=anonymous;skipServerCertificateValidation=true;useCertificate=FromFile;certificateStoreLocation=LocalMachine;certificateStoreName=My;certificateFilePath=QlikServer1.domain.local\client.pfx;trustedLocations=qrs_proxy%2https://localhost:4244;queryParameters=xrfkey%20000000000000000;addMissingQueryParametersToFinalRequ... %%userid%%2sa_api;PaginationType=None;"
6. Once all of the Data Connections have been modified, then you can attempt a Reload via the QMC of one of the Monitoring Applications (e.g: License Monitor)
PowerShell Script Option
Attached to the article is a zip file that includes a PowerShell Script that can preform all of the steps above. You can download and extract the script to your Central node.
(Nothing is deleted by running this script only renamed. If you would like to revert back prior to running the script, just swap the Data connections back in the QMC (they have -old appended to them)
1. Run the script as your Qlik Sense Service Account on the Central Node
2. Old Data connections used by the Monitoring Apps will be renamed: Example - monitor_apps_REST_app --> monitor_apps_REST_app-old
3. The Data Connections will be modified to use certificate authorization instead of Windows Authentication (This will create a password protected Certificate at [ProgramData]\Qlik\Sense\Engine\Certificates using the FQDN of the Central Node)
4. Additional considerations: In multi-node environments where the central node does not perform reloads, the certificate generated will have to be moved to the corresponding folders on the other nodes: By Default, [ProgramData]\Qlik\Sense\Engine\Certificates\Central Node Name (keep the folder name the same)
Hello @agigliotti
I can't say specifically why the new connection was not created in your environment, but the PowerShell script already does have the coding to create the (monitor_apps_REST_license_xxxxx). I just ran it again in my environment and you can see the 11 data connections with the owner being "sa_api"
