Talend Remote Engine Heart Beat is failing hourly with 'GOAWAY received' error and the karaf.log shows below:

2024-08-01T10:16:58,638 | ERROR | pool-28-thread-1 | JAXRSUtils | 469 - org.apache.cxf.cxf-rt-frontend-jaxrs - 3.6.2 | | Problem with writing the data, class org.talend.ipaas.rt.engine.model.HeartbeatInfo, ContentType: application/json
2024-08-01T10:16:58,638 | WARN | pool-28-thread-1 | PhaseInterceptorChain | 467 - org.apache.cxf.cxf-core - 3.6.2 | | Interceptor for {http://pairing.rt.ipaas.talend.org/}PairingService has thrown exception, unwinding now
org.apache.cxf.interceptor.Fault: Problem with writing the data, class org.talend.ipaas.rt.engine.model.HeartbeatInfo, ContentType: application/json
Caused by: java.io.IOException: /<IP>:<port>: GOAWAY received

This could also be a possible solution when the following error is also showing in the log:

Caused by: java.io.IOException: HTTP/1.1 header parser received no bytes

Resolution

1. Stop Remote Engine.
2. Edit the <RemoteEngineInstallation>/etc/org.talend.ipaas.rt.pairing.agent.cfg file and replace the line 

   heartbeat.interval=60 (by default) 

   with 

   heartbeat.interval=65

3. In the file <RemoteEngineInstallation>/etc/system.properties, remove or comment out the line below (if it exists):
   

   org.apache.cxf.transport.http.forceVersion=1.1​

4. Restart Remote Engine.

Do not set heart interval to more than 180 seconds(3 mins). If Talend Cloud does not receive a heartbeat from the Remote Engine for more than 3 mins, it will show the Remote Engine's status as unavailable.

Cause

The connection to the server pair.xx.cloud.talend.com is kept during 60 seconds and Heartbeat.interval > 60 seconds allows to close this connection and prevent "GOAWAY received" error message.

Related Content

For more information about heartbeat concept and heartbeat interval, please refer to documentation:

Monitoring-remote-engine-health

Internal Investigation ID(s)

 Internal Jira Case ID: TMC-4122

Environment

Talend Cloud 

A Binary Load on a Qlik Sense App located in the Qlik Sense App share fails. 

The following error is logged in the Script Log: 

Environment:

Qlik Sense Enterprise on Windows 
QlikView 

There are four main requirements for a successful binary load:

1. Binary load must be the first statement in the load script
2. Only one binary load statement per script
3. The source QVW or QVF file must be available during the entire binary load*
4. The reloading user must have access to read the source QVW or QVF file*

*Binary Loads from live Qlik Sense Apps are not supported in Qlik Sense Enterprise on Windows.

Example: BINARY [SenseAppID];  (for example BINARY 2d405d18-ddd3-5353-5128-adce12e482bd;)

QVF files in the Server Apps folder are read/written by Engine service when:

1. When users are doing modifications on those apps, so a file lock will be always possible to happen on those files at any moment.
2. In a multi-node environment, apps are constantly being synchronized(called 'binary sync) onto all nodes, which means any changes on such app from any node will have the possibility to lock the app.
3. And some 'binary sync does not happen instantly. The sync actions will be delayed for several hours when the system load is high. So the file lock is very unpredictable.

During these operations, those files may be locked and causing reload task failure.

Resolution

For Qlik Sense:

Do binary load on static QVF/QVW files if necessary, or load QVD files generated by other QVD generators.

What to generally consider:

• Binary load is not the first command line in the script
  It is a requirement that binary load is the first executable command in the load script. See below online help references:
  Qlik Sense: Binary Load
  QlikView: Binary Load 
   
• The source application is Section Access protected
  The reloading user must be allowed to access and open the file being targeted in the binary load. This means that the QlikView or Qlik Sense service user must be included in the Section Access table. 
   
• Source QVW is updated by another task during binary load
  No other task can update the source QlikView (QVW) or Qlik Sense (QVF) application file during the binary load. 
   
• Source QVW is locked by 3rd party process, like anti-virus or backup
  No other software can lock the source QlikView (QVW) or Qlik Sense (QVF) application file during the binary load. 
   
• Source QVW is located on a file share, and file share access is interrupted by network problem
  Any file share hosting the source QlikView (QVW) or Qlik Sense (QVF) application file must be available during the binary load.

This article provides information on how to set up Multi-Factor Authentication (MFA) for your Qlik Talend Cloud login when using Qlik ID to log in.

How can I set up Multi-Factor Authentication for my Qlik Talend Cloud Account for Qlik ID login?

Qlik Talend Cloud has been migrated to a unified Qlik ID login. Since then, multi-factor authentication can be enabled as described in How to Setup Multi-Factor Authentication (MFA) for Qlik Sense Business. 

These steps are specific for Qlik ID only. If you already have an SSO provider set up (not Qlik ID), Multi-Factor authentication must be configured on the third party provider (see Configuring single sign-on (SSO) for Talend Cloud).

1. Install a Multi-Factor Authentication (MFA) app on your phone, such as Google Authenticator, LastPassAuthenticator, Microsoft Authenticator, or similar.

   Using only a QR reader will not work. An MFA Authenitcator app is required.

2. Go to your Qlik ID portal and log in with your Qlik ID
3. Navigate to the Password & Security settings (link)
4. Follow the instructions for setting up MFA as documented in How to Setup Multi-Factor Authentication (MFA) for Qlik Sense Business.
   1. In Password & Security, scroll to Multi-Factor Authentication and click Setup
   2. Scan the QR code with your Authenticator app
   3. Follow the onscreen instructions in your Authenticator app to complete the setup
   4. Save the provided Recovery Code.

      This code is mandatory in case you need to recover your account. A new one will be generated after use; always save the most recent one.

   5. Multi-Factor Authentication is now enabled.

Environment

• Qlik Talend Cloud

Upgrading Qlik Sense Enterprise on Windows fails with a generic error message:

An error has occurred
For detailed information see the log file

The Qlik Sense Repository Database service is no longer installed after the failed installation.

This means that the database password validation did not complete and a partial rollback has occurred. This has removed the database software, but it has not removed the database itself.

The database password is normally password is checked before the upgrade process begins, but under some circumstances, such as the database service being stopped, this check does not occur. Once the new version of the database software is installed it will attempt to open the database as part of the install verification process and will fail. This then prompts a rollback of the database software and removing the new version.

Resolution:

Reinstall Qlik Sense. (Uninstall, Reinstall)

During the uninstall process, do not remove the certificates or database. 

Once Qlik Sense is uninstalled, you can proceed to install the desired upgraded version of Qlik Sense, the installer will detect the existing database and request the password, if it is from an earlier version the installer will make the necessary changes as part of the installation process.

Environment:

Qlik Sense Enterprise on Windows 

This is a companion article to Qlik Sense Enterprise for Windows - New Security Patches Available Now  and only applies to the patches affected by QB-30633.

If you have experienced issues with visualizations and extensions not loading after upgrading to the security patches released on the 4th of December 2024, upgrade to the new patches which address QB-30633:

• May 2024 Patch 11
• February 2024 Patch 15
• November 2023 Patch 17
• August 2023 Patch 17
• May 2023 Patch 19
• February 2023 Patch 16

If visualizations and extensions do not behave as expected after the upgrade, follow the outlined steps below:

• If the extensions are not available in the Qlik Sense Management Console, on the file share, as well as in the assets panel
  
  Solution:
  
  Restart the Qlik Sense Services services, then verify again
  
  
• If the extensions are available in the Qlik Sense Management Console, on the file share, as well as in the assets panel, but not visible in any of your Qlik Sense apps
  
  Solution:
  
  Clear the browser cache
  
  
• If sheets are not rendering and the error 'an error occured' is thrown
  
  Solution:
  
  Clear the browser cache
  
  
• If extensions continue to not import or load, regardless of the above two steps taken.
  
  Solution:
  
  
  1. Stop the Qlik Sense Repository service
  2. Open the file C:\Program Files\Qlik\Sense\Repository\Repository.exe.config
  3. Go to the section <appSettings>
  4. Add the key VisualizationExtensionsExtractFilter as the last key in the <appSettings> section:
     
     <add key="VisualizationExtensionsExtractFilter" value="md|css|js|json|pdf|png|qext|txt|html|htm|gif|jpg|jpeg|wbl|otf|ttf|woff|woff2|eot|svg|bmp|mp3|jp2"/>
     
     
  5. Save the file
  6. Restart the Qlik Sense Services

If issues continue regardless, contact support so that we can assist you effectively.

Environment

• Qlik Sense Enterprise on Windows May 2024 Patch 11
• Qlik Sense Enterprise on Windows February 2024 Patch 15
• Qlik Sense Enterprise on Windows November 2023 Patch 17
• Qlik Sense Enterprise on Windows August 2023 Patch 17
• Qlik Sense Enterprise on Windows May 2023 Patch 19
• Qlik Sense Enterprise on Windows February 2023 Patch 16

QlikView QVD files contain lineage information of the stored data. 

Environment:

QlikView any version

The lineage information can be found in the QVD file XML header and might look like below, with connection details and the SQL statements used during reload. 

Resolution:

1. Open Qlikview Desktop client 
2. Go to Help > About Qlikview...
3. Right click the QlikView logo in the bottom right corner
4. Highlight the AllowDataLineage value
5. Set the value to -1 to disable the Lineage information
6. Click Set to store the value change
7. Close the settings and about dialog boxes
8. Reload the QVD generator application
   
   

1. Open the QlikView Server’s batch settings.ini file in a text editor. Default file path; C:\Windows\System32\config\systemprofile\AppData\Roaming\QlikTech\QlikViewBatch\Settings.ini
2. Add AllowDataLineage=-1 in the [Settings 7] section of the settings file. 
3. Save the settings file and close text editor
4. Restart QlikView Server, to trigger loading of the altered settings 
5. Reload the QVW file from QlikView management console to see that the setting has been changed
6. To enable the lineage information follow the steps above, but set the Value to 0 instead of -1 in step 5.

TAC task failed to start randomly, with the following error displayed as follows:

Job start failed because of parallel clean jobId = 20250318 155947 gfsl3or deplovment.comons.exception.clientserverException: org.talend.remote.commons,exception,clientserverException: job start failed because of paralrq.talend.remotecleanupdeployment jobId = 20250318 155947

Cause

The value assigned to the 'org.talend.remote.jobserver.commons.config.JobServerConfiguration.MAXOLDEXECUTIONS_LOGS' parameter in the TalendJobServer.properties file was set too low, specifically at 30.

Resolution

Adjust the value of 'org.talend.remote.jobserver.commons.config.JobServerConfiguration.MAXOLDEXECUTIONS_LOGS' parameter to a default setting of 1000 or a higher number in the TalendJobServer.properties file. For example:

org.talend.remote.jobserver.commons.config.JobServerConfiguration.MAXOLDEXECUTIONS_LOGS=1000

Environment

• Talend Administration Center 8.0.1

Creating a new SAP Extractor endpoing in Qlik Talend Cloud fails with the following error:

[INFO ] Sending services health status: {"type":"poll_replicate_async_request","payload":{"request_type":"services_status_change_report","jobId":"Uxg6kx6963IMPloynt-1hCD_sQa-DktO","requestedContext":{"servicesStatus":[{"Name":"local_repsrv","State":"CONNECTED","Message":null},{"Name":"qdi-db-commands","State":"CONNECTED","Message":null},{"Name":"external-data-provider","State":"CONNECTED","Message":null}]}}}
13 2025-03-26 10:46:34 [Service ] [ERROR] Failed analyzing request, traceId: 7e8a49232266af1bb1dee5dae84edcf7
Attunity.Infrastructure.Globals.AttInfrastructureException: SYS-E-HTTPFAIL, Failed to load dynamic endpoint properties.
at Attunity.Infrastructure.Globals.AtRestApiClientUtils.DoWebRequestIntern(String address, String method, String[] headers, Object body, Stream outStream, String contentType, Boolean isReconnect)
at Attunity.Infrastructure.Globals.AtRestApiClientUtils.DoWebRequest(String address, String method, String[] headers, Object body, Stream outStream, String contentType)
at Attunity.Aem.Globals.DirectRequest.ReplicateDoWebRequest(ReqData reqData, Stream requestStream)
at Attunity.Infrastructure.HostManager.RestHandler.Dispatch(ReqData reqData, Stream requestStream, DispatchResponseFormat responseFormat)
at Attunity.Infrastructure.HostManager.RestHandler.Dispatch(ISession session, String requestUrl, RestHttpMethod httpMethod, Stream requestStream)
at QCSConnectionBroker.QcsConnectionBroker.OnMessage(String jsonMessage)

Resolution

Correct the password or create a password that avoids special characters. 

Cause

The error is caused by an invalid password or the password being used has special characters, such as !@#$%^&*()_+.

Internal Investigation ID(s)

QCDI-1424

Environment

• Qlik Talend Cloud

Qlik Sense Enterprise for Windows has a default “Task Session timeout“ of 1440 minutes (24 hours) and “Max retries” of 0.
 
“Task Session timeout“ is the maximum period of time before a task is aborted. When a task is started, a session is started by the manager scheduler and the task is performed by one of the worker schedulers. If the session times out, the manager scheduler forces the worker scheduler node to abort the task and remove the session.
 
Qlik Help: Creating reload tasks from tasks

 
Reload tasks performance is affected by many factors, which can make a reload significantly slower than anticipated.

• Data source capacity
• Data source process priority
• Network bandwidth
• Network path
• Network congestion
• Poor internet access

 
“Task Session timeout“ can be used to terminate a task that runs longer than expected, to avoid resource constraints with other parallel tasks. It is recommended to set “Task Session timeout“ lower than the task trigger interval, for example, lower than 60 minutes for hourly reload.
 

 
Each failed task will rerun the number of times defined in “Max retries”, which has to be considered when defining “Task Session timeout“.

It is recommended to set “Task Session timeout“ and “Max retries” so that all retries with maximum timeout can be executed within the task trigger interval, for example, 3 retries of 19 minutes can be executed between each hourly reload.
 

 
 
 
 

Repctl dumpmetadadqa is a command that retrieves the table structure from the Metadata folder.

The structure can provide helpful information about table changes between source and target or manifest the source and target DDL.

To achieve this:

1. Open a command line as an administrator (elevated permissions)
2. Move to ~ Attunity\Replicate\bin
3. Run:

   repctl dumpmetadata sqlite_file="C:\Users\administrator\Downloads\Full Load Task and CDC - ANADDR__diagnostics__20250321170305\Metadata\dynamic_metadata.sqlite"

   Make sure the path used is correct. 
   
   A successful command will return:
   
   command dumpmetadata response:
   {
          "out_dir":      "C:\\Users\\administrator\\Downloads\\Full Load Task and CDC - ANADDR__diagnostics__20250321170305\\Metadata\\20250324123730263852"
   }
   [dumpmetadata command] Succeeded
   
   
   
   
4. Browse to the newly created folder (example: Metadata\2025033112622103323)
   
   
   
   
5. Open the numbered folder (example: 2025033112622103323)
   
   
   
   
6. Open table_defs. Our example has returned the following tables:
   
   
   
   
7. Use an editor of your choice (example Notepad++) to compare the source and target tables:
   
   
   
   

Environment

• Qlik Replicate

The Qlik Sense Engine or QlikView Server service may register the following warnings in the logs:

Environment

• QlikView 
• Qlik Sense Enterprise on Windows 

Resolution

The host operating system may be running out of sufficient resources for the Engine to perform its tasks. The numbers supplied by the system indicate the current usage of memory by the Engine service against the Low Working Set Limit configured for the Qlik Engine. 

The depletion warning indicates that a memory load needs to be addressed, such as through purging more aggressively since the cache memory has dramatically reduced. So, it is an early warning to free the memory needed by the generic cache.

Example after startup:

Information    WorkingSet: Configured Working Set Size is 4.200-5.400 GB (setting 70%-90%)

Where 70% is the (default) Low limit, translating to 4.200 GB.

Warning    WorkingSet: Virtual Memory is growing beyond parameters - 5.205(4.200) GB
Warning    WorkingSet: Virtual Memory is growing CRITICALLY beyond parameters - 5.496(4.200) GB

Additional Resources

Explanation of Memory in Sense: Qlik Engine Memory Management
Determining requirements: How Much Memory Is Required For A Qlik Server Deployment?

 

All candidates can review their exam history and score reports by logging into Pearson VUE and utilizing the “My Account” menu.

Qlik is partnering with Credly to provide digital badges and certificates for our Qlik Product Certifications. 24-48 hours after you pass your exam, you will receive an email from Credly. Follow the instructions in the email to accept your digital badge and access your certificate.

If you experience issues while accepting your digital badge, please contact Credly support.

More information, see: Certifications and Qualificiations 

QlikView and Qlik Sense load either missing or additional zeros, compared to the values in the data source. 

For example data like in the below script is loaded with incorrect leading zeros. 

LOAD * Inline [
F1, F2
1, a
01, b
02, c
2, d
];

On the second row the leading zero is missing, and on the fourth row, there is an unexpected additional leading zero.

Environment:

QlikView 
Qlik Sense Enterprise on Windows 
Qlik Cloud 

Cause:

The observed behaviour is a part of fundamental Qlik engine functionality and data compression technique. 

In short, this means that Qlik interprets and associates loaded data by best effort. As part of Qlik optimization and compression technique the same reoccurring value in a field is stored on the first occurrence only, and the following occurrence reference to the first (stored) value. This means that two values with identical numerical representation can not be stored with two different textual presentations in the same field in Qlik.

Please keep in mind that all numerical values in Qlik act as dual values. This means that they have an underlying numerical value that is used for calculations, and a textual formatted value which is the value seen in charts or as calculations results. 

In the example below four rows of data are loaded. In the field F1 there are four different value.

LOAD * Inline [
F1, F2
1, a
01, b
02, c
2, d
];

1. The first value in F1 is interpreted by Qlik as a numerical 1
2. The first value is stored as numerical value 1 with textual presentation 1
3. The second value in F1 is interpreted by Qlik as a numerical 1
4. There is already a numerical value 1 stored in the field F1, so Qlik associates the second occurrence to the first value. This means that the value 01 will be associated as a numerical 1 with presentation value 1.
5. The third value in F1 is interpreted by Qlik as a numerical 2
6. There is no other value stored in the field  F1 as a numerical 2, hence this value is stored as numerical 2 with the textual presentation value 02.
7. The fourth value in F1 is interpreted by Qlik as a numerical 2
8. There is already a numerical value 2 stored in the field F1, so Qlik associates the second occurrence to the first value. This means that the value 2 will be associated as a numerical 2 with presentation value 02.
9. The loaded data will visually not look like the data source. 
   
   
   

    

Resolution:

Identical numerical values are associated with the same textual presentation value in Qlik . For this reason, it is not possible to store the same numerical value with different textual presentation values. 

One way to resolve this is to format the values as text by using Text() during reload. 

LOAD 
    text(F1) as F1,
    F2
Inline [
F1, F2
1, a
01, b
02, c
2, d
];

This will result in the visual values looking identical to the data source. 

NOTE: Value formatted with Text() will not have underlying numerical values, hence calculations on these values is not possible. 

While working with DB2 LUW endpoint, Replicate reports error after the 64-bit IBM DB2 Data Server Client 11.5 installation:

SYS-E-HTTPFAIL, Cannot connect to DB2 LUW Server.
SYS,GENERAL_EXCEPTION,Cannot connect to DB2 LUW Server,RetCode: SQL_ERROR SqlState: IM003 NativeError: 160 Message: Specified driver could not be loaded due to system error 1114: A dynamic link library (DLL) initialization routine failed. (IBM DB2 ODBC DRIVER, C:\Program Files\IBM\SQLLIB\BIN\DB2CLIO.DLL).

Resolution

Install the 64-bit IBM DB2 Data Server Client 11.5.4 (for example 11.5.4.1449) rather than 11.5.0 (actual version is 11.5.0.1077).

Environment

Qlik Replicate                        : all versions

Replicate Server platform: Windows Server 2019
DB2 Data Server Client      : version 11.5.0.xxxx 

Internal Investigation ID(s):

Support cases, #00076295

 Qlik Replicate 

While attempting to run a Job in TAC, an error occurred as follows:

ERROR ExecutionTaskHandler - Port value out of range: 75543
java.lang.IllegalArgumentException: Port value out of range: 75543

These port values will vary in each entry of the technical logs.

Cause

This error will be caused due to a change in the default TCP port range in the TAC configuration table. The TAC configurations table contains a configurable value named "scheduler.conf.statisticsRangePorts". A valid TCP port falls within the range of 1 to 65535, typically between 1024 and 65535. The default value for this parameter is 10000-11000. If this value is exceeded, you will encounter this error in TAC.

Resolution

To address this issue, please follow these steps:

1. Stop TAC.
2. Change the value to the default range of 10000-11000 for the parameter “scheduler.conf.statisticsRangePorts” in the configuration table located in the TAC database.
3. Start TAC.

Environment

• Talend Administration Center 8.0.1

Talend CICD publishing encountered an error stating 'Failed to retrieve the latest release version: Found'. The detailed error messages can be found in the log file:

ERROR] Failed to execute goal org.talend.ci:cloudpublisher-maven-plugin:8.0.10:publish (default) on project CICD_DM_IRIS_Test_connections: Get the latest published version failed: Found: RedirectionException -> [Help 1]
org.apache.maven.lifecycle.LifecycleExecutionException: Failed to execute goal org.talend.ci:cloudpublisher-maven-plugin:8.0.10:publish (default) on project CICD_DM_IRIS_Test_connections: Get the latest published version failed: Found
   at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:306)
Caused by: org.apache.maven.plugin.MojoExecutionException: Get the latest published version failed: Found
   at org.talend.cloud.publisher.CloudPublisher.execute (CloudPublisher.java:324)
Caused by: org.talend.ipaas.services.inventory.InventoryException: Found
   at org.talend.ipaas.services.inventory.client.InventoryClient.convertToInventoryException (InventoryClient.java:188)
   at org.talend.ipaas.services.inventory.client.InventoryClient.getLatestActionVersion (InventoryClient.java:95)
   at org.talend.cloud.publisher.CloudPublisher.execute (CloudPublisher.java:309)
Caused by: javax.ws.rs.RedirectionException
   at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0 (Native Method)

Cause

The Talend Service URL parameter -Dservice.url has an incorrect configuration.

Resolution

Update the Talend Service URL parameter -Dservice.url to https://tmc.<region>.cloud.talend.com/inventory, where <region> corresponds to your tenant region, which can be: us, eu, or ap. For instance:

-Dservice.url=https://tmc.us.cloud.talend.com/inventory 

Environment

• Talend Data Integration 8.0.1

In certain use cases, it may be necessary to use an IP address/path with the following root IP address, 169.254.169.254, with a custom connection or other variables attached to a task in TMC. However, if you attempt to save the task for deployment/running while using this IP address, TMC may display an error message stating "Unable to Save Task Configuration".

Cause

The IP Address in question, 169.254.169.254, is a custom instance metadata IP address used across different Cloud Service Providers, such as AWS or Azure, which Qlik/Talend Cloud is hosted on. In many cases, these Cloud Service Providers utilize that IP address to retrieve information about Virtual Machines, such as configuration details and network settings. Consequently, the Cloud Service Providers will automatically block any application (such as TMC) from using that entry on the backend.

In terms of TMC, if the aforementioned IP address is used, TMC will attempt to save that entry on the backend. Nevertheless, since AWS/Azure has blacklisted that IP address, it will block the task from saving the entry on the backend. This will cause TMC to resend the request, displaying the message "Unable to Save Task Configuration".

Resolution

If the IP address in question is intended for use in a content, resource, or connection, there are a couple of suggested solutions.

• Use a DNS name that can either be resolved internally (such as DNS on the specific VLAN/internal network) or add the DNS name as an entry in the /etc/hosts file on the instance where the Remote Engine resides.
• Modify the Job to enable base64 encryption/decryption of the value, so it cannot be detected by the Cloud Service Provider.
• Split and concatenate the URL to ensure that the value is not directly provided by TMC to the Cloud Service Provider.

If, after testing and validating the aforementioned solutions, the issue persists with creating, saving, or modifying tasks, kindly contact Qlik Support.

Internal Investigation ID(s)

SUPPORT-1875

Environment

• Talend Data Integration 8.0.1

In Qlik Application Automation when trying to connect a connector of the Office 365 suite, some users will experience the following message during the authentication flow:

This error can show up for the Microsoft Teams, Microsoft Onedrive, Microsoft Sharepoint and Microsoft Excel connectors and depends on your Office 365 tenant. This article explains different methods on how to allow users to make a connector from Qlik Application Automation.

When an Azure admin navigates to the Consent and Permissions page inside Enterprise Applications, the following will be visible:

Admin Consent Request Workflow

If the option Do not allow user consent is selected, the only way to get the Microsoft connectors in Qlik Application Automation working is by enabling the Admin Consent Request workflow. To do this, the admin needs to navigate to Admin consent settings and enable the request box and assign reviewers for each request justification:

When a user now creates a connection, they will be asked to provide a justification. This request will be sent to the Azure Administrators of the tenant:

When this request is submitted, the reviewers of the request should now see the request:

The reviewer can review the request which takes the reviewer to the consent screen with the option to allow access for the organization. This will install an enterprise application in the Azure tenant of the user.

Classifying low impact permissions

An alternative option is if the Azure tenant selected the option Allow User Consent from verified publishers for selected permissions. 

When this option is chosen, an Azure administrator of the tenant can head to the Permission Classifications page:

The following scopes will have to be classified as low impact for the different connectors:

Microsoft Teams/Sharepoint ( with admin consent )

This connector will always require admin consent and these scopes cannot be classified as being low impact.

This article provides a guide on how to configure a Qlik Sense Enterprise on Windows Virtual Proxy with OIDC authentication.

This customization is provided as is. Qlik Support cannot provide continued support of the solution. For assistance, reach out to our Professional Services or engage in our active Integrations forum.

On Google Workspace

1. Follow the instructions in How To: Setting up OAuth 2.0 Google Cloud Platform
2. Create an OAuth client ID
   
   
   
   
3. Note your Client ID and Client Secret
4. Configure the Authorized redirect URIs
   
   
   
   Change the URIs per your environment's requirements.
   
   In this case I’m using the same app to authenticate Qlik Sense Client-Managed and Qlik Cloud as well.
   
   URIs must be a fully qualified domain name (FQDN) such as, https://qliksenseserver.domain.local.
   
   
5. Once finished, download the config json file

Setting up Qlik Sense for OIDC with Azure ID

1. Create a new virtual proxy in the Qlik Sense Management Console and configure it based on your requirements (such as choosing an Engine to load balance to, your host allow list, and associating a Proxy service).
2. Choose OIDC as the authentication method and configure it as follows:
   
   
   
   The fields to pay attention to are:
   
   
   • OpenID Connect metadata URI: https://accounts.google.com/.well-known/openid-configuration
   • Client ID: Can be found in the Google Console > Additional information
   • Client secret: Can be found in the Google Console > Client Secret, and is available when downloading the config json file
   • scope: openid email profile

Environment

• Qlik Sense Enterprise on Windows
• Google Workspace

How to decrypt a heavily encoded SAML message. 

If you have set up the Identity Provider to encrypt the SAML assertion, then in order to see what it contains for troubleshooting, you will need to decrypt it.

Environment:

Qlik Sense Enterprise on Windows , all versions

It is important to understand the 3 below concepts when using SAML.

• Inflation and base-64 encoding
• Signing
• Encryption

A SAML AuthnRequest is:

• Inflated and base-64 encoded (If you use a SAML browser extension, it will deflate it and decode it automatically for you. In order to do that manually, https://www.samltool.com/decode.php can be used.)
  No private key is needed to deflate/decode.
• Signed, so that it cannot be altered. The signature does not hold any useful information for troubleshooting, it is just to make sure that the SAML request hasn't been altered. However if the certificate it has been signed with does not correspond, you won't be able to authenticate.
  The Qlik Sense certificate is needed to validate the signature on the SAML assertion. (Note: Qlik Sense always signs SAML AuthnRequest, this cannot be disabled, however SAML AuthnRequest signature validation can be disabled in the Identity Provider)

A SAML assertion (The assertion is a section in the SAML response) is:

• Inflated and base-64 encoded (If you use a SAML browser extension, it will deflate it and decode it automatically for you. In order to do that manually, https://www.samltool.com/decode.php can be used.)
  No private key is needed to deflate/decode.
• Signed, so that it cannot be altered. The signature does not hold any useful information for troubleshooting, it is just to make sure that the SAML request hasn't been altered. However if the certificate it has been signed with does not correspond, you won't be able to authenticate.
  The Identity Provider certificate is needed to validate the signature on the SAML assertion.
• Encrypted (Optionally). In this case, in order to see if information in the SAML assertion are correct, decrypting the SAML assertion is needed.
  It can be decrypted with https://www.samltool.com/decrypt.php, just paste the deflated/decoded SAML request.
  The Qlik Sense certificate private key is needed to see what the signature holds.
  The SAML response is generated by the Identity Provider and the public certificate of the Service Provider (Qlik Sense) is used to encrypt. You will need the private key of Qlik Sense to decrypt it.
   

Resolution:

1. Go to https://www.samltool.com/decrypt.php
2. In Encrypted XML, paste the deflated/decoded SAML response.
3. In Private Key*, paste the private key of Qlik Sense.

Related Content:

How To Use SAML Authentication With Qlik Sense