The logout button in Qlik Sense Hub does not work when using Qlik Sense through a reverse proxy.
Looking into the browser developer tools (F12), the logout URL points directly to the Qlik Sense server name instead of the reverse proxy name.
Resolution
Solution for September 2018 and later
The name that the logout URL must be rewritten to must be specified in the X-Forwarded-Host header.
This header must be added to the reverse proxy configuration rules.
Below is an example for IIS, however, the same logic applies to other kinds of reverse proxies:
<rule name="QlikReverseProxyAll" enabled="false" patternSyntax="ECMAScript">
<match url="(.*)" />
<conditions logicalGrouping="MatchAll" trackAllCaptures="false">
</conditions>
<action type="Rewrite" url="https://qlikserver1.domain.local/{R:0}" />
<serverVariables>
<set name="HEADER_X-Forwarded-Host" value="10.76.200.11" />
</serverVariables>
</rule>
In September 2019 and later, if SSL off-loading is used (Use of HTTP between the reverse proxy and the Qlik Sense server and of HTTPS between the reverse proxy and the end user), then the X-Forwarded-proto or the Forwarded header can be used.
<rule name="QlikReverseProxyAll" enabled="false" patternSyntax="ECMAScript">
<match url="(.*)" />
<conditions logicalGrouping="MatchAll" trackAllCaptures="false">
</conditions>
<action type="Rewrite" url="http://qlikserver1.domain.local/{R:0}" />
<serverVariables>
<set name="HEADER_X-Forwarded-Host" value="10.76.200.11" />
<set name="HEADER_X-Forwarded-proto" value="https" />
</serverVariables>
</rule>
Alternative:
<rule name="QlikReverseProxyAll" enabled="false" patternSyntax="ECMAScript">
<match url="(.*)" />
<conditions logicalGrouping="MatchAll" trackAllCaptures="false">
</conditions>
<action type="Rewrite" url="http://qlikserver1.domain.local/{R:0}" />
<serverVariables>
<set name="HEADER_Forwarded" value="host=10.76.200.11;proto=https" />
</serverVariables>
</rule>
Workaround
Workaround for June 2018 and earlier:
You must create an entry in the Reverse Proxy host file to point the external DNS name to the Qlik Sense server.
From the client:
externaldnsalias will point to the reverse proxy server.
From the reverse proxy server:
externaldnsalias will point to the Qlik Sense server.
In the below example, qlikserver4.domain.local is the external DNS alias.
The following configuration example is for IIS (This is using global rules set in the applicationHost.config file, but the same can be done using website rules in web.config):
<rewrite>
<globalRules>
<clear />
<rule name="QlikReverseProxyAll">
<match url="(.*)" />
<conditions logicalGrouping="MatchAll" trackAllCaptures="false" />
<action type="Rewrite" url="https://qlikserver4.domain.local/{R:0}" />
</rule>
<rule name="AuthForwarding">
<match url="form/" />
<conditions logicalGrouping="MatchAll" trackAllCaptures="false" />
<action type="Rewrite" url="https://qlikserver4.domain.local:4244/{R:0}" />
</rule>
<rule name="Windows_Auth">
<match url="/windows_authentication/" />
<conditions logicalGrouping="MatchAll" trackAllCaptures="false" />
<action type="Rewrite" url="https://qlikserver4.domain.local:4244/{R:0}" />
</rule>
</globalRules>
</rewrite>
On the reverse proxy server, in the host file (in C:\Windows\System32\drivers\etc\ for Windows), add the following line:
172.16.16.100 qlikserver4.domain.local
172.16.16.100 is the IP of the Qlik Sense server.
When you ping qlikserver4.domain.local on the reverse proxy server, you should see the IP address of the Qlik Sense server.
When you ping qlikserver4.domain.local on the client, you should see the IP address of the reverse proxy machine.
Once the above settings performed, you should now be able to log out from the hub.
Internal Investigation ID(s):
QLIK-87698
