Integrated Windows Authentication (IWA) with Qlik using Internet Explorer, Chrome and Firefox

[Sonja_Bauernfeind]

How to enable "Integrated Windows Authentication" (IWA authentication) in Qlik Sense and QlikView. Windows Integrated Authentication allows a user’s Active Directory credentials to pass through their browser to a web server.

If you would like to do the reverse and always prompt for username and password, then the opposite settings will need to be taken. 

Environment:

QlikView 
Qlik Sense Enterprise on Windows 
Qlik NPrinting 

Internet Explorer:

Step 1, enable IWA: 

1. Go to the Windows Control Panel and select Network and Internet
2. Open Internet Options
   
   
   
   
3. Select the Network Zone you want to configure (Trusted sites or Local intranet) 
4. Open custom level...
   
   
   
   
5. Scroll to the bottom and click Automatic Logon with current username and password
   
   
   
   

If you are looking to configure your Trusted sites and add your Qlik server:

1. Click Trusted Sites
2. Click Sites
   
   
   
   
3. Add your desired domain name.
   
   

Google Chrome:

Google Chrome in Windows will use Internet Explorer settings

Firefox:

1. Navigate to the URL about:config in Firefox. 
2. Proceed by clicking Accept the Risk and Continue
   
   
   
   
3. In the search bar, search for: network.automatic-ntlm-auth.trusted-uris
   
   Add your domain.
   
   
   
   

[MeehyeOh]

Hi, @ Albert_Candela Io, @Sonja_Bauernfeind 

please check this 

https://community.qlik.com/t5/New-to-Qlik-Sense/Active-Directory-user-cannot-login-Qliksense-Enterpr...

Thanks!!

[Just6]

Hi,

I followed the steps from above. Unfortunately, Qlik Sense does not log in automatically in my Edge browser, what could be the reason? Do I need to take any other steps?

Thanks and Regards!

[Sonja_Bauernfeind]

Hello @Just6 

This would need to be specifically reviewed for Edge by your internal IT. 

Maybe one of these will help:

Windows Integrated Authentication (WIA) (learn.microsoft.com)
Integrated Windows authentication in Microsoft Edge (stackoverflow)

I've tested the above in a local install of Microsoft Edge and authentication was correctly passed through. You may need to verify that your Trusted Sites are set up to allow Integrated Authentication, which your IT can assist you with.

All the best,
Sonja 

[Skage]

@Sonja_Bauernfeind 

What determines what account is picked up in Sense with WIA when there are more than one domain that are allowed.

Example: Sense is running with two directory-syncs for two separate domains. The server is running in one domain and the users are logged into the other domain in windows. A random number of users are not recognized as their window-login-domain-user and the rest works just fine. Everyone use Edge or Chrome. Afik they all have the same userid in both domains.

I know Sense has to trust the authentication that the client initiate and Sense validate via the domain controller/s upon access. 
The dns-name to the server is matching the domain the machine and service account is located in.

I need to validate that this isn't a Sense-problem and articulate what IT need to look into.

TIA!