When only a Unique Index Key is defined in the source, the task will by default create a non-clustered key in the target.

This article documents how to create a Primary Key in the target by introducing an Internal Parameter at the SQL Server target. 

Resolution

Source: Oracle
Target: SQL Server

Add the following parameter:

• $info.query_syntax.create_index  
• Value: ALTER TABLE ${QO}${TABLE_OWNER}${QC}.${QO}${TABLE_NAME}${QC} ADD CONSTRAINT ${QO}PK_${TABLE_NAME}${QC} PRIMARY KEY ( ${COLUMN_LIST} ) 

Make sure columns with a unique index defined at the source, as well as columns that are marked as Key Manually in the UI, have the NOT NULL constraint enabled.

Environment

• Qlik Cloud
• Talend Cloud

QTAC-2537 R2026-08 patch introduced a label sorting issue in the Talend Job Conductor.

Sorting the label on the Execution Plan page in previous patches works as expected. The issue is specific to sorting label names in the Job Conductor, whereas sorting the label name in ascending or descending order fails. 

Resolution

This issue will be fixed in an upcoming Talend Administration Center patch. If a solution is required as soon as possible, another alternative is to revert to a previous patch, as this only impacts version QTAC-2537 (R2026-08).

Review the Talend Release Notes for details.

Internal Investigation ID(s)

QTAC-2707

Environment

• Talend Administration Center

Jobs show significantly degraded performance when running on a Dynamic Engine compared to executing on a Remote Engine.

Environment:

• Talend Cloud

Resolution

On a Dynamic Engine, the job runs inside a pod, i.e., a container. This container has its own operating system and libraries, separate from the host node. Because of this, it is sometimes necessary to add Java options at job launch (for example, on a run profile in the Talend Management Console) to allocate more resources to the job inside the container.

There are two main options to add, depending on the root cause of the problem:

Large data volume processing (memory-bound)

This is typically a memory issue. Add the following options:

1. Kubernetes-specific:

   • -XX:MaxRAMPercentage= sets the maximum JVM heap size as a percentage of the memory allocated to the container (similar to Xmx).
     
     

2. Talend-specific, at the container level (not the job itself):

   • -K8S:PodRAMRequest=
   • -K8S:PodRAMLimit=
     
     

   These set the memory usage for the pod itself.

Complex data processing (CPU-bound)

When the processing logic itself is complex, it is preferable to adjust the CPU allocation instead. By default, a job is limited to 30% of the Kubernetes node's CPU. This limit exists mainly to prevent a single job from completely freezing the node.

This limit can be raised with the following options, which allocate more CPU to the pod:

• -K8S:PodCPURequest specifies the initial CPU allocation for the pod.
• -K8S:PodCPULimit sets an upper limit on the pod's CPU usage, preventing it from monopolizing CPU resources.

Examples:

• -K8S:PodCPURequest=0.5: request to use 50% of node CPU for the job
• -K8S:PodCPULimit=1: can use up to 100% of node CPU
• -XX:MaxRAMPercentage=50: allocate 50% of pod RAM for the job heap size

Cause

The default CPU usage is 0.3, as defined in the Dynamic Engine's env file. This value is set to prevent any node CPU overhead.

This article explains how to retrieve data using Qlik Sense Analytics (on-premises and Cloud) from SAP OData services, taking into account the 2026 SAP security patches.

Background

An SAP security patch released in June 2026 technically blocks third-party use of the ODP framework over RFC (SAP Note 3255746). This is the interface most dedicated SAP connectors used. Only ODP via RFC is affected, not RFC in general, and SAP names ODP via OData as the compliant fallback for data access outside SAP systems. A time-limited revert option exists but expires in December 2026 (SAP Note 3731818).

Only Qlik's SAP ODP connector (Qlik Cloud) is affected. Depending on the access level you have in your SAP environment, you can also use our SAP connectors to extract data from SAP NetWeaver SAP connectors in Qlik Sense Client Managed, Qlik Cloud and QlikView (these are not affected by SAP restrictions).

But if data extraction only relies on OData services, Qlik's OData connector or REST connector are the only alternative.

Requirements

What is needed on the SAP side (macro level):

• AP Gateway as the OData layer. Every OData service is served by SAP Gateway (NetWeaver Gateway), either embedded in the ABAP system or as a separate hub. In S/4HANA, it's built in. This is the component that turns backend objects into OData endpoints.
• Service activation. A service must be registered and activated in /IWFND/MAINT_SERVICE (plus the underlying ICF node in SICF). SAP ships thousands of standard services inactive by default. Activation per service is a deliberate admin step, not automatic.
• A user and authorizations. A dedicated communication/service user with S_SERVICE for the endpoint plus the application-level authorizations for the data behind it. Gateway auth doesn't bypass application auth — if the user can't see the plant in SAP, the OData service won't return it either.
• Network and authentication. HTTPS with a trusted certificate and an auth method. The consumer supports:
  • Basic Auth (the simple on-prem case)
  • OAuth2/SAML for cloud scenarios
    In S/4HANA Cloud (public edition), the connection runs through communication scenarios/arrangements rather than manual Gateway configuration. For Qlik Cloud Analytics reaching an on-prem Gateway, either the endpoint is reachable from the cloud, or you go through Qlik Data Gateway – Direct Access.
• For ODP-based services, additionally, the Operational Delta Queue (ODQ) must be active, and the source object must be released for ODP extraction. Delta then works via the OData subscription/delta-link mechanism backed by ODQ.

What can be exposed as OData

Two families

Family A: ODP-based OData services. SAP Gateway can generate an OData service on
top of the ODP framework, and then the answer is essentially yes — anything ODP
supports:

• DataSources/Extractors. SAPI context: the classic 2LIS_* logistics extractors, FI
  extractors, etc., released via RSA5
• ABAP CDS views annotated with @Analytics.dataExtraction.enabled: true (ABAP_CDS
  context), delta-capable when the change-data annotations are set
• BW/BW4HANA InfoProviders. BW context
• SLT-based table replication. SLT context
• HANA information views

These services are generated in the Gateway Service Builder (SEGW) via the ODP-
extraction wizard. They support full load plus genuine delta — the extractor's delta logic
is preserved and exposed through OData delta tokens.

Family B: regular (non-ODP) OData services. Anything the ABAP stack can model:

• A CDS view with @odata.publish: true (one annotation, auto-generated service)
• Hand-built services in SEGW (mapping DDIC tables, CDS as reference data source,
  BAPIs/RFCs, or custom code)
• RAP service bindings (OData V2/V4). The modern S/4HANA way
• The standard APIs delivered from the SAP Business Accelerator Hub

These have no delta mechanism by default. Incremental loads are your problem as the
consumer. Typically $filter on a change date or timestamp field, which only works if the
underlying object carries one reliably.

Limitation with the generic OData connector in Qlik Sense Client Managed

The generic OData connector speaks plain OData, which is fine for Family B and for full loads only from Family A. (delta load can only be managed with a REST connector).

OData is a chatty protocol. While paging, $select to trim width, and gzip help, nobody should plan a nightly full load of BSEG-scale tables over it.

Options to retrieve data from SAP ODATA services

In Qlik Cloud Analytics

• How to connect to data from SAP OData services and retrieve data with Qlik Cloud Analytics REST connector

In Qlik Sense Enterprise on Windows

• How to connect to data from SAP OData services and retrieve data with Qlik Sense Enterprise on Windows REST connector
• How to connect to data from SAP OData services and retrieve data with Qlik Sense Enterprise on Windows ODATA connector

Environment

• Qlik Cloud
• Qlik Sense Enterprise on Windows
• QlikView

This article explains how to connect to data from SAP OData services and retrieve data with the Qlik Sense Enterprise on Windows ODATA connector.

Requirements

• A valid SAP account to access the ODATA services in the SAP environment
• (Optional) A certificate installed on the Qlik Sense Enterprise on Windows server if you communicate with the ODATA services through SSL

Configuration

1. Create a new application in your Qlik Sense workspace, and go to the Data Load editor
2. On the right panel, click New Connection and choose the ODATA connector
3. Configure the connection:
   1. Enter the URL of the SAP ODATA service and your credentials
   2. Test the connection, then click Save
      
      

How to retrieve and load data

1. Identify the entities (resources) of the ODATA service
   1. On the data connection you created, click the Data button
      
      
      
      
   2. On the left menu, choose ListResources (A) and enter $format=xml (B) in the OData Query Options, then choose application/atom+xml in Accept (C) and click Preview data (D)
      
      
      
      
      
      
   3. Retrieve the list of entities
      
      
   4. Check and click GetData, then enter the following parameters:
      • The name of the entity from which you want to retrieve data in OData Resource Path
      • $format=xml in OData Query Options
      • Application/atom+xml in Accept
        
        
        
        
   5. Click Preview data
      
      
   6. Click on Insert script
      
      
      
      
      
      
2. The next step is to curate the load statement and optionally provide business-friendly names for the SAP fields.
   
   Example:
   
   
   
   
3. Repeat all steps for each entity you want to retrieve data from. Then curate the load script to avoid synthetic keys and build a functional data model in your analytic application.

The example in this article is provided as is and only documents a basic option. Further customization can be achieved using a data architecture with QVD layers.

Optional: Instead of manually going through all the steps, it is possible to use an LLM and a skill on SAP and Qlik to generate a first curated version of the full load script by providing the LLM the metadata file of the OData service. It would save some time in the building process.

Environment

• Qlik Sense Enterprise on Windows

This article explains how to connect to data from SAP OData services and retrieve data with the Qlik Sense Enterprise on Windows REST connector.

Requirements

• A valid SAP account to access the ODATA services in the SAP environment
• Optional: A certificate installed on the Qlik Sense Enterprise on Windows server if you communicate with the ODATA services through SSL

Configuration

1. Create a new application in your Qlik Sense workspace, and go to the Data Load editor
2. On the right panel, click New Connection and choose the REST connector
3. Configure the connection:
   1. Enter the URL of the SAP ODATA service
      
      
      
      
   2. Choose Basic Authentication and enter your credentials
      
      
      
      
   3. Under Query parameters, add sap_client and enter its value; do the same for $format, then check Allow “WITH CONNECTION”
      
      
      
      
   4. Test the connection, then click Save

How to retrieve and load data

1. Identify the entities (resources) of the ODATA service
   1. On the data connection you created, click the Data button
      
      
      
      
   2. Expand the left menu and choose EntitySets
      
      
      
      
   3. Retrieve an Entity from the list, edit the connection again, and paste the Entity at the end of the URL
      
      
      
      
   4. Test and save the connection
      
      
   5. Expand the left menu and tick results:
      
      
      
      
   6. Click on Insert script
      
      
      
      
2. The next step is to curate the load statement by adding the WITH CONNECTION statement and defining variables for the SAP environment used in the connection.
   
   Example:
   
   
   
   (Optional) Followed by providing business-friendly names for the SAP fields.
   
   Example:
   
   
   
   
   
3. Repeat all steps for each entity you want to retrieve data from. Then curate the load script to avoid synthetic keys and build a functional data model in your analytic application.

The example in this article is provided as is and only documents a basic option. Further customization can be achieved using a data architecture with QVD layers.

Optional: Instead of manually going through all the steps, it is possible to use an LLM and a skill on SAP and Qlik to generate a first curated version of the full load script by providing the LLM the metadata file of the OData service. It would save some time in the building process.

Environment

• Qlik Sense Enterprise on Windows

This article explains how to connect to data from SAP OData services and retrieve data with the Qlik Cloud Analytics REST connector.

Requirements

• A valid SAP account to access the ODATA services in the SAP environment
• A functional Qlik Data Gateway Direct Access
• The SAP OData generic URL added in the gateway settings under the REST connector; the URLs are case-sensitive
  
  
  
  
• Optional: A certificate installed on the Qlik Sense Client Managed server if you communicate with the ODATA services through SSL

Configuration

1. Create a new application in your Qlik Sense workspace, and go to the Data Load editor
2. On the right panel, click New Connection and choose the REST connector
3. Configure the connection:
   1. Choose the data gateway and enter the URL of the SAP ODATA service; do not forget the forward slash (/) at the end of the URL
      
      
      
      
   2. Choose Basic Authentication and enter your credentials
      
      
      
      
   3. Under Query parameters, add sap_client and enter its value; do the same for $format, then check Allow “WITH CONNECTION”
      
      
      
      
   4. Test the connection, then click Save

How to retrieve and load data

1. Identify the entities (resources) of the ODATA service
   1. On the data connection you created, click the Data button
      
      
      
      
   2. Select JSON as Response type and expand the left menu, then choose EntitySets
      
      
      
      
   3. Retrieve an Entity from the list, edit the connection again, and paste the Entity at the end of the URL
      
      
      
      
   4. Test and save the connection
      
      
   5. Expand the left menu and check results:
      
      
      
      
   6. Click on Insert script
      
      
      
      
2. The next step is to curate the load statement by adding the WITH CONNECTION statement and defining variables for the SAP environment used in the connection.
   
   Example:
   
   
   
   (Optional) Followed by providing business-friendly names for the SAP fields.
   
   Example:
   
   
   
   
   
3. Repeat all steps for each entity you want to retrieve data from. Then curate the load script to avoid synthetic keys and build a functional data model in your analytic application.

The example in this article is provided as is and only documents a basic option. Further customization can be achieved using a data architecture with QVD layers.

Optional: Instead of manually going through all the steps, it is possible to use an LLM and a skill on SAP and Qlik to generate a first curated version of the full load script by providing the LLM the metadata file of the OData service. It would save some time in the building process.

Environment

• Qlik Cloud Analytics

Testing the PostgreSQL Source Endpoint in Qlik Replicate may fail with the following error:

Failed to load Postgres driver. Cannot load libpq.dll

Resolution

You should have two entries in the system environment variables pointing to the following folders (default locations):

• C:\Program Files\PostgreSQL\12\bin
• C:\Program Files\psqlODBC\1202\bin

Both folders must include the libpq.dll file.

If the connection test fails even with libpq.dll present in both directories, then:

1. Copy the libpq.dll file from odbc\bin (C:\Program Files\psqlODBC\1202\bin) to  ~\Replicate\bin 
2. Restart the Qlik Replicate server service and the Replicate UI server service

Environment

• Qlik Replicate

After upgrading Qlik Compose from 2022.5 to 2023.11 or 2024.12, attempting to generate and run the Data Mart job fails with the following error:

SQL compilation error: invalid identifier "MASTER_CONSIGNMENTLEG_MASTER_CONSIGNMENT_GLOBI_consignment_INVOICE_GLOBI_relations_OID" 

Resolution

To resolve, change the "is_pk" property from false to true for the OID columns in the Aggregate Fact definition.

For new Data Mart jobs, the OID column defaults to true. This issue only affects older Aggregate Facts that include dimensions.

Detailed steps:

1. Create a deployment package of the project where the issue exists.
2. Extract the ZIP file and open the JSON file.
3. Locate the Aggregate Fact table definition in the JSON file that has the issue. For example: FACT_GLOBI_AGG_FINANCIAL_PLAN_NON_FIN_REP.
   
   
   
   
4. Locate the _OID columns within the Aggregate Fact definition.
   For example, FACT_GLOBI_AGG_FINANCIAL_PLAN_NON_FIN_REP contains four OID columns:
   • S_sec_department_id_GLOBI_department_GLOBI_department_OID
   • S_invoice_relation_id_GLOBI_relations_GLOBI_relations_OID
   • S_sec_branch_id_GLOBI_branchGLOBI_branch_OID
   • S_sec_branch_id_GLOBI_relation_address_GLOBI_branch_OID
5. For each _OID column, check the value of the "is_pk" property.
6. If "is_pk" is set to false for any _OID column, update it to true.
7. Save the changes, then re-ZIP the JSON file along with the readme.txt file.
8. Deploy the updated ZIP file into the existing project.
9. Regenerate the statements for the Data Mart.
10. Run the Datamart ETL job.

Environment

• Qlik Compose

The CICD publishing phase may fail with the following error:

org.talend.ci:cloudpublisher-maven-plugin:8.0.13:publish (default) on project <project>: Get the latest published version failed

This article identifies the two most common root causes and their solutions:

Get the latest published version failed: Unauthorized
Caused by: jakarta.ws.rs.NotAuthorizedException: HTTP 401 Unauthorized

Get the latest published version failed: Not Found
Caused by: jakarta.ws.rs.NotFoundException: HTTP 404 Not Found

Identify which root cause applies to you by reviewing the log stack.

Resolution

Unauthorized

This indicates an invalid Talend Management Console (TMC) token and may require a review of what TMC region is currently in use.

Resolution

• Validate the TMC token. If unsuccessful, create a new token to use.
• Verify the TMC region: Storing your global variables in Jenkins 

Not Found

Not Found points to an incorrect TMC URL.

Resolution

• Review the TMC URL currently configured as per Storing your global variables in Jenkins 

Internal Investigation ID(s)

00470337, 00470122

Environment

• Talend Data Integration

While reloading data from a SQL server using ODBC or OLE DB connection, the error below is seen in Hub. Part of this may also be reference in the reload script logs.


The following error occurred:
Connector reply error: ***

The error occurred here:


Data has not been loaded. Please correct the error and try loading again.

Environment:

• Qlik Sense Enterprise on Windows 

The error above may indicate a typo, incorrect syntax, or incorrect table naming in the reload script. It generally does not indicate a connectivity issue or inability to query data in the source SQL database.

Resolution:

Confirm there are no typos, incorrect syntax, or incorrect table naming in the reload script. One way to approach this is by going to the "Select Data" option on the Connection listed in Hub, re-selecting the desired data to be loaded, and "Inserting Script" for comparing if there were any changes in the database since the reload script was first created.

Qlik Replicate task data synchronization failed to replicate data from SQLMI to an AS400 (iSeries/DB2) target via an ODBC endpoint, with new tasks failing during initialization when generating and executing CREATE TABLE statements for internal control tables (such as attrep_apply_exceptions) on the target.

Example error:

Attributes not valid

Detailed log:

Stream component 'st_0_AS400 - PSFWEB - MC - Target' terminated
Stream component failed at subtask 0, component st_0_AS400 - PSFWEB - MC - Target
Error executing command
Cannot create Exception table
Cannot create Special table
execute create table statement failed, statement CREATE TABLE "attrep_apply_exceptions" ( "TASK_NAME" VARCHAR(128) NOT NULL, "TABLE_OWNER" VARCHAR(128) NOT NULL, "TABLE_NAME" VARCHAR(128) NOT NULL, "ERROR_TIME" TIMESTAMP NOT NULL, "STATEMENT" CLOB(0) NOT NULL, "ERROR" CLOB(0) NOT NULL )
RetCode: SQL_ERROR SqlState: 42000 NativeError: -604 Message: [IBM][System i Access ODBC Driver][DB2 for i5/OS]SQL0604 - Attributes not valid.
Failed (retcode -1) to execute statement: CREATE TABLE "attrep_apply_exceptions" ( "TASK_NAME" VARCHAR(128) NOT NULL, "TABLE_OWNER" VARCHAR(128) NOT NULL, "TABLE_NAME" VARCHAR(128) NOT NULL, "ERROR_TIME" TIMESTAMP NOT NULL, "STATEMENT" CLOB(0) NOT NULL, "ERROR" CLOB(0) NOT NULL )

Resolution

Set Provider Syntax to DB2 in the target endpoint.

• Go to your Target Endpoint
• Switch to the Advanced tab
• Set the correct Provider Syntax 

  Engage Qlik's Professional Services for more direct assistance for custom ODBC endpoint setups due to provider-specific SQL syntax rules.

Cause

SQL0604 / NativeError -604 means Db2 for IBM i rejected an invalid data-type attribute, typically a column or expression with an unsupported length, precision, scale, timestamp precision, or ALLOCATE value. This is normally an SQL-definition problem, not a network or ODBC connection problem. (on QR V2023.5.0.322)

The task fails because Qlik Replicate generates this invalid Db2 for i definition:

"STATEMENT" CLOB(0) NOT NULL,
"ERROR"     CLOB(0) NOT NULL

On Db2 for IBM i, a CLOB length must be between 1 byte and 2 GB. Therefore, CLOB(0) produces SQL0604 / -604 – Attributes not valid.  Other column definitions are valid.

That indicates the target endpoint is missing or uses the wrong configuration for the Endpoint --> Advanced tab --> Provider syntax setting.
 

Environment

• Qlik Replicate

Creating a Target Logical System fails while executing the TCODE in SAP QTQVC/EXTREP, citing SAP Extractor Source Error /QTQVC/EXTR060.

See Activate the extractors for Replicate for the documented setup steps. 

Resolution

• To verify if you have sufficient IDOCs available, use TCODE WE20 or WE02. Contact your SAP Basis team for details on the IDOC limit for your environment.
• To verify if the Target Logical System is already defined, check the /QTQVC/SRCLOGSYS table.
• To verify if the IDOC was created at all, check the RSBASIDOC table.

Cause

Two likely root causes:

• The SAP environment has run out of allocated IDOCs (Intermediate Docs)
• A Logical Target System with the same name already exists

Environment

• Qlik Replicate

Loading data from the source (PostgreSQL/Raw) to the Teradata target via JDBC using the tDBOutput component in Talend Studio may lead to the following write error:

[ERROR] tDBOutput - [Teradata Database] [TeraJDBC 20.00.00.58] [Error 6706] [SQLState HY000] The string contains an untranslatable character.

Environment

• Talend Studio

Resolution

• DDL Update: Update the non-Unicode table column definitions on the Teradata target to unified Unicode-based types (e.g., NVARCHAR / CHARACTER SET UNICODE).
• JDBC Configuration: Apply CHARSET=UTF8 to the JDBC connection string to align session parameters with incoming data streams.

After applying the changes, verify the write operations. Data loading will resume successfully without untranslatable character errors.

Cause

The issue was identified as a character-set conversion failure. Analysis of the Teradata table DDL revealed that certain target columns were configured with non-Unicode definitions (e.g., standard VARCHAR without Unicode encoding), preventing Teradata from storing multi-byte character strings passed from Talend during insertion.

Environment

• Talend Studio

The following error may trigger when executing a job in Qlik Talend Studio through a target execution:

Execution failed :org.talend.remote.jobserver.commons.utils.io.JobLimitException: Unzipped file name exceeds the maximum length: '240' (configured in org.talend.remote.jobserver.commons.config.JobServerConfiguration.MAX_UNZIPPED_FILE_NAME_LENGTH) [Unzipped file name exceeds the maximum length: '240' (configured in org.talend.remote.jobserver.commons.config.JobServerConfiguration.MAX_UNZIPPED_FILE_NAME_LENGTH)]

Resolution

To resolve, set the MAX_UNZIPPED_FILE_NAME_LENGTH=1024 parameter in both the Remote Engine org.talend.remote.jobserver.server.cfg and Talend Studio.ini file:

• Remote Engine/etc/org.talend.remote.jobserver.server.cfg:
  

   org.talend.remote.jobserver.commons.config.JobServerConfiguration.MAX_UNZIPPED_FILE_NAME_LENGTH=1024

• Studio.ini:
  

  Dorg.talend.remote.jobserver.commons.config.JobServerConfiguration.MAX_UNZIPPED_FILE_NAME_LENGTH=1024

Environment

• Talend Studio

The Microsoft Fabric Connector is not currently supported as a target system.

A connection using the Azure Storage connector may succeed and pass testing, but reloads will fail with "Operation not supported" on the specific endpoint.

Qlik is actively working on enhancements to provide the functionality in the future: 

• TLV-2349: New Connector for Microsoft Fabric (Discovery)
• TLV-1841: Qlik Open Lakehouse (Iceberg) Connector for Qlik Analytics (Discovery)

A specific release date has not yet been determined.

Stay up to date with the Qlik Cloud changelog. 

Environment

• Qlik Cloud Analytics

Amazon S3 V2 connections and reloads fail with the following error:

Could not load file or assembly 'System.Text.Json, Version=6.0.0.11, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51' or one of its dependencies. The located assembly's manifest definition does not match the assembly reference. (Exception from HRESULT: 0x80131040) 

Affected versions:

• Qlik Sense Enterprise on Windows November 2024 SR 25 and SR 26
• Qlik Sense Enterprise on Windows May 2025 SR 15 to SR 18
• Qlik Sense Enterprise on Windows November 2025 SR 3 to SR 8

Resolution

This is a known defect (SUPPORT-8609). QvWebStorageProviderConnectorPackage.exe.config is not correctly overwritten during the upgrade process.

Upgrade to the following versions:

• Qlik Sense Enterprise on Windows November 2024 SR 27 or higher
• Qlik Sense Enterprise on Windows May 2025 SR 19 or higher
• Qlik Sense Enterprise on Windows November 2025 SR 9 or higher

Information provided on this defect is given as is at the time of documenting. For up-to-date information, please review the most recent Release Notes or contact support with the ID SUPPORT-8609 for reference.

Cause

Product Defect ID: SUPPORT-8609

Configure Kerberos-based Windows Authentication on a Linux machine for the Qlik application user, enabling seamless SQL Server connectivity without manual credential management.

The information in this article is provided as-is and will be used at your discretion. Depending on the tool(s) used, customization(s), and/or other factors, ongoing support on the solution below may not be provided by Qlik Support.

1. Confirm the Qlik user exists on the Linux machine and switch to the with:
   

   id qlik

   sudo su - qlik

   whoami

2. Install the required packages (Kerberos client tools, Microsoft ODBC Driver 18, and sqlcmd)  by running the following command as root:
   
   

   sudo yum install -y krb5-workstation krb5-libs

3. Edit the Kerberos configuration file ( /etc/krb5.conf) as root. Delete all existing content and replace it with the following:
   

   sudo vi /etc/krb5.conf

   
   Configuration content:
   

   includedir /etc/krb5.conf.d/

   [logging]
     default = FILE:/var/log/krb5libs.log
     kdc = FILE:/var/log/krb5kdc.log
     admin_server = FILE:/var/log/kadmind.log
   [libdefaults]
     default_realm = <CUSTOMER_DOMAIN_URL>
     dns_lookup_realm = false
     ticket_lifetime = 24h
     renew_lifetime = 7d
     forwardable = true
     rdns = false
     pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
     dns_canonicalize_hostname = fallback
     qualify_shortname = ""
     default_ccache_name = KEYRING:persistent:%{uid}
   [realms]
     <CUSTOMER_DOMAIN_URL> = {
       kdc = <customer_domain_url>
       admin_server = <customer_domain_url>
     }
     RDLUND.<CUSTOMER_DOMAIN_URL> = {
       kdc = RDLund.qliktech.com
       admin_server = RDLund.qliktech.com
     }
   [domain_realm]
     .qliktech.com = QLIKTECH.COM
     qliktech.com = QLIKTECH.COM

4. Switch to the Qlik user and generate a keytab file using ktutil. The keytab allows kinit to run without a password.

   sudo su - qlik

   ktutil

   1. Inside the ktutil prompt, enter the following commands:
      

      addent -password -p <service_account_user>@<email_domain> -k 1 -e aes256-cts-hmac-sha1-96

      # Enter password when prompted
      

      addent -password -p <service_account_user>@<email_domain>.COM -k 1 -e arcfour-hmac

      # Enter password again when prompted
      

      wkt /home/qlik/<service_account_user>.keytab

      quit

   2. Secure the keytab file:

      chmod 600 /home/qlik/<service_account_user>.keytab

      chown qlik:qlik /home/qlik/<service_account_user>.keytab

   3. Verify the keytab was created correctly:
      

      klist -kt /home/qlik/<service_account_user>.keytab

5. As the Qlik user, test the keytab authentication by destroying any existing tickets and authenticate using the keytab

   kdestroy

   kinit -kt /home/qlik/<service_account_user>.keytab <service_account_user>@QLIKTECH.COM

   klist

   Expected output from klist:
   
   Ticket cache: KCM:XXXX
   Default principal: <service_account_user>@QLIKTECH.COM
   
   Valid starting Expires Service principal
   04/23/2026 04:14:45 04/23/2026 14:14:31 krbtgt/QLIKTECH.COM@QLIKTECH.COM
   
   
6. As the Qlik user, test the SQL connection
   
   Using isql without DSN:
   

   isql -k "Driver={ODBC Driver 18 for SQL Server};Server=<SQL_Server_FQDN>;Database=TEST_AD;Trusted_Connection=yes;TrustServerCertificate=yes;Encrypt=no;" -v

7. Create a ticket renewal script that checks and renews the Kerberos ticket automatically

   vi /home/qlik/renew_krb.sh

   Script content:
   

   #!/bin/bash
   LOG=/home/qlik/krb_renew.log
   echo "$(date) - Checking Kerberos ticket..." >> $LOG
   klist -s
   if [ $? -ne 0 ]; then
     echo "$(date) - Ticket expired, renewing..." >> $LOG
     kinit -kt /home/qlik/<service_account_user>.keytab <service_account_user>@QLIKTECH.COM >> $LOG 2>&1
     if [ $? -eq 0 ]; then
       echo "$(date) - Ticket renewed successfully" >> $LOG
     else
       echo "$(date) - ERROR: Renewal failed!" >> $LOG
     fi
   else
     echo "$(date) - Ticket valid, renewing proactively..." >> $LOG
     kinit -R >> $LOG 2>&1 || kinit -kt /home/qlik/<service_account_user>.keytab <service_account_user>@QLIKTECH.COM >> $LOG 2>&1
   fi

   
   Make the script executable:
   

   chmod +x /home/qlik/renew_krb.sh
   chown qlik:qlik /home/qlik/renew_krb.sh

8. Configure a cron job to run the renewal script every eight hours and on reboot:
   

   sudo crontab -u qlik -e

   
   Add the following lines:
   

   # Renew Kerberos ticket every 8 hours
   0 */8 * * * /home/qlik/renew_krb.sh
   
   # Renew on system reboot
   @reboot /home/qlik/renew_krb.sh

9. Create a systemd service to ensure the ticket is always maintained, even after reboots:
   

   sudo vi /etc/systemd/system/krb5-qlik.service

   
   Service file content:
   

   [Unit]
   Description=Kerberos Ticket Renewal for Qlik User
   After=network.target
   
   [Service]
   Type=simple
   User=qlik
   ExecStart=/bin/bash -c 'while true; do kinit -R || kinit -kt /home/qlik/<service_account_user>.keytab <service_account_user>@QLIKTECH.COM; sleep 28800; done'
   Restart=always
   RestartSec=10
   
   [Install]
   WantedBy=multi-user.target

   
   Enable and start the service:
   

   sudo systemctl daemon-reload
   sudo systemctl enable krb5-qlik
   sudo systemctl start krb5-qlik
   sudo systemctl status krb5-qlik

   The service runs an infinite loop that tries to renew the ticket every eight hours (sleep 28800). If renewal fails, it falls back to getting a fresh ticket from the keytab. It auto-starts on every boot.

10. Run an end-to-end verification by performing the following checks to confirm everything is working correctly:
    
    
    1. Check Kerberos ticket:

       sudo su - qlik

       klist

    2. Check renewal log:
       

       tail -f /home/qlik/krb_renew.log

    3. Check systemd service status:
       

       sudo systemctl status krb5-qlik

    4. Test SQL connection from Qlik Talend Cloud
       
       The following configuration is mandatory when working with Kerberos:
       
       Account properties: username and password
       Database properties: Enter database name manually, checked; Database name; Name
       Internal properties: useTrusted Connection set to true; useTrustedServerCertificate set to true
       
       
       
       
       
       
       

Environment

• Qlik Talend Cloud

A Qlik Replicate task targeting a file-based endpoint (ADLS, S3, File, or GCS) intermittently:

• Fails to resume cleanly after a target-side error (such as a connection timeout, recoverable error, or task restart)
• Shows missing or incomplete records at the target compared to the source, with no corresponding data error logged
• Logs errors indicating Replicate could not locate an expected temporary (.tmp) file during file post-processing or resume.

These symptoms are most likely to appear in tasks where table or schema names contain a forward slash (/) or a backslash (\).

Resolution

Qlik Replicate provides an internal parameter, enableSlashInTableName, to allow slash characters in table and schema names.

To enable the parameter: 

1. Open the file-based target endpoint settings (ADLS, S3, File, or GCS).
2. Go to the Advanced tab and click Internal Parameters.
3. Add the parameter enableSlashInTableName and set it to Checked.

   If the parameter is not visible or unavailable in your current Qlik Replicate version, upgrade to v2025.11.0.437 or later.

4. Save and restart the task (a full reload may be required).

The data_files folder within the task needs to be empty before resuming. If the folder was not empty, a full reload will be required.

Recommendation for New Task Design

For any new file-based target task (ADLS, S3, File, GCS):

• Avoid transformation rules that introduce / or \ into table or schema names.
• If a folder-like structure is the goal (e.g., grouping tables under a parent folder), review whether the target's native folder-mapping options can achieve this without modifying the table name itself, before resorting to a slash-prefix transformation rule.

Cause

This is a known limitation.

File-based targets map table and schema names directly into the target's folder and file path structure (such as <target_folder>/<schema>/<table>/<file>.csv). If a table or schema name contains a / or \ character, whether from the source system itself or introduced by a Qlik Replicate transformation rule, Qlik Replicate can misinterpret that character as a path separator rather than as part of the object name.

See Limitations and considerations | Using a file as a target.

A common way this condition is introduced unintentionally is through a Global Transformation Rule that renames tables and adds a / (or \) as a prefix or suffix, for example, a rule such as:

Even though this may be intended to create a logical folder grouping at the target, it produces an effective table name containing a slash, which is not supported by the underlying file-target path handling. When Replicate then needs to locate the staged .tmp file for that table, and most commonly during resume after a task restart or a recoverable target error, the malformed path can prevent it from finding the correct file, resulting in a stalled resume or, in some cases, records that are never applied to the target.

Environment

• Qlik Replicate

By Giacomo Brioschi, Principal Solution Architect, Qlik | Sathisan Vannadil, Senior Partner Solutions Architect, AWS | Sunil Yerkola, Senior Solutions Architect, ISV, AWS.

This guide walks you through the complete setup to bridge Amazon Quick and the Qlik MCP server, enabling real-time access to trusted Data Products with Qlik Trust Score for governed, AI-ready data, and insights and context from the Qlik Analytics Engine, all from within Amazon Quick.

Content

• What you'll need
• Step 1: Configure user roles for MCP access
• Step 2: Assign the new MCP role to users or groups
• Step 3: Create a new OAuth client for Amazon Quick
• Step 4: Add the Qlik MCP server as a connection in Amazon Quick
• Step 5: Create a new chat agent in Quick that uses the Qlik MCP server as an action
• Step 6: The power of Amazon Quick and the Qlik MCP server in action
• Troubleshooting
• Related Content

What you'll need

• An active AWS account
• Amazon Quick setup with user rights to create Connectors
• A Qlik Cloud tenant where you have Tenant Admin rights

Step 1: Configure user roles for MCP access

A Qlik tenant administrator must create (or update) a custom user role that grants the Qlik MCP permission. Without this, users will authenticate successfully but won't be able to execute any MCP tools.

1. In the Administration activity center, click Manage users.
2. Go to the Permissions tab and click Create new.
3. Assign a name to the role (e.g., MCP User) and under Features and actions > Agentic AI, set the MCP permission to Allowed.
4. Click Save.
   
   Setting the MCP permission to Allowed under Features and actions in a Qlik Cloud custom role
   

Step 2: Assign the new MCP role to users or groups

1. In the Administration activity center, click Manage users and go to the All users tab.
2. Click the three-dot menu (...) (A) on the right side of the user's row and select Manage roles (B).
   
   
   
   
3. Assign the MCP role to each user who needs access to the Qlik MCP server. Alternatively, you can assign the new role to a group of users.
   
   
   
   
4. Save your changes.

This can also be done from the Permissions tab. Use the Auto assign drop-down to give permission to all users in your tenant.

Space permissions and Section Access rules still apply. The MCP role grants access to the MCP server itself, but what each user can see and do through MCP is governed by their existing Qlik Cloud permissions. See Qlik MCP server access and permissions for details.

Step 3: Create a new OAuth client for Amazon Quick

The OAuth client authenticates and scopes user access when Quick connects to the Qlik MCP server. A tenant administrator must create an OAuth client for the integration. Once the OAuth client is ready, you can add the Qlik MCP server as a connection in Quick.

Alternatively, you can use OAuth Dynamic Client Registration (DCR), which allows an LLM client to register itself automatically with Qlik Cloud, without the tenant administrator needing to create an OAuth client in advance.

For more information, see how to connect to the Qlik MCP server and how to create OAuth clients for LLM clients in our online help.

Amazon Quick supports two OAuth client types for User authentication: Web (server-side, browser-based redirect flow) and Native (client-side, PKCE-based flow without a backend secret). Choose the one that best fits your security requirements and use case. The following section describes the Web configuration as an example.

1. In your Qlik Cloud tenant, navigate to the Administration activity center.
2. Go to OAuth and click Create new.
3. For the Client type, select Web.
4. Enter a name for the OAuth client (e.g., Amazon Quick MCP) and optionally add a description.
5. Under Scopes, select user_default and mcp:execute.
   
   
   
   Optionally add offline_access to reduce re-authentication frequency to once every 30 days from the default 6-hour expiry.
   
   
6. Under Add redirect URLs, enter the authentication callback URL for Quick as a redirect URI: https://{region}.quicksight.aws.amazon.com/sn/oauthcallback. Replace {region} with your AWS Region (for example, us-east-1).
   
   
   
   
7. Click Create.
8. Immediately copy the Client ID and Client Secret; you'll need both in the next step to configure the integration on the Amazon Quick side, and the secret won't be shown again.

Important, tenant admin must connect first: according to Qlik documentation, the tenant administrator has to be the first user to connect and authenticate with any new MCP client. This establishes tenant level trust between Quick and the Qlik OAuth app. Until the admin completes this first connection, other users' connection attempts will fail. Make sure the admin completes the Quick side integration (Step 4) and authenticates before rolling out access to other users.

Step 4: Add the Qlik MCP server as a connection in Amazon Quick

This step is performed in Amazon Quick, not in Qlik Cloud.

In this final configuration step, you will create an Amazon Quick connection to the Qlik MCP server to access your trusted data foundation. Once this is completed, you will be able to use your Amazon Quick Chat Agents to invoke the available tools to retrieve insights from Qlik. Instructions for adding a remote MCP server connection in Quick will depend on the Quick integration UI.

At a high level:

1. Sign in to Amazon Quick using your web browser.
2. Go to More on the sidebar menu, select Connectors, and click Model Context Protocol within the list of supported connectors.
3. On the Create integration screen, enter the Name and Description for your Qlik MCP integration. For the MCP server endpoint, enter the URL of the Qlik MCP server as https://{your-tenant-hostname}.{your-tenant-region}.qlikcloud.com/api/ai/mcp, as shown in the screenshot below, and make sure to replace {your-tenant-hostname} and {your-tenant-region} with the hostname and region of your Qlik Cloud tenant.
   
   
   
   
4. Choose Next once you're done.
5. In the following Authenticate screen, select User Authentication as the Authentication method, Custom user based OAuth as the Auth Configuration, and enter the following details:
   1. Enter the Client ID and Client Secret that you previously copied from the Qlik OAuth client you created in Step 3. If you chose Native as the OAuth client type, leave Client secret empty.
   2. Token URL allows a client to perform an OAuth flow with Qlik to obtain a token set. Enter your token URL as https://{your-tenant-hostname}.{your-tenant-region}.qlikcloud.com/oauth/token, replacing your-tenant-hostname and your-tenant-region with the hostname and region of your Qlik Cloud tenant. 
   3. The Authorization URL is the URL that the MCP server uses to retrieve the authorization token. Enter your Authorization URL as https://{your-tenant-hostname}.{your-tenant-region}.qlikcloud.com/oauth/authorize, again replacing the tenant hostname and region placeholders.
      
      
      
      
6. Click Create and Continue.
7. Authenticate by signing into your Qlik Cloud tenant when prompted.
8. Click Approve to authorise Quick to access your Qlik Cloud data.

   Data sharing notice: by clicking Approve, you enable the Qlik MCP server to share your Qlik Cloud data with Amazon Quick. Quick is not managed by Qlik, and your data will be stored and processed under AWS's control. Check your organisation's AI data sharing policies before proceeding.

   
   
   
9. In Manage Tools & Permissions, you can list the tools available for read and write operations, and in the final section, Publishing the connection, you have the option to share this connection with your team members, e.g., with users or a group of users who can access the Qlik MCP server via Amazon Quick.
   
   In this example, the connection has been shared with a group called Qlik Test.
   
   
   
   
10. Click Publish to create the connection.
11. If the integration creation has been successful, you should be able to see the list of actions (tools) available within the connector, as shown in the snapshot below:
    
    
    
    For a complete list of Qlik tools available, see Qlik MCP tools | help.qlik.com.

Step 5: Create a new chat agent in Quick that uses the Qlik MCP server as an action

With the connector in place, the tools that the Qlik MCP server provides are now available within Amazon Quick. Chat Agents in Amazon Quick help users explore data, analyse information, and take actions through open-ended natural language conversations, now including Qlik's capabilities. Agents are configured with specific goals, knowledge sources, and connected tools, and can evolve from simple question answering to orchestrating complex workflows. You can use chat agents to:

• Generate content and provide answers through natural language conversations
• Analyse and summarise information from connected spaces, dashboards, topics, datasets, and uploaded files
• Invoke actions to perform predefined steps for consistent, repeatable outcomes

For more information, see Create, customize, and deploy AI-powered chat agents in Amazon Quick | docs.aws.

Let's explore together how to create an Agent in Amazon Quick that uses the Qlik MCP server connection.

1. When you are in Amazon Quick, go to More on the left sidebar and click Chat Agents, then select Create a chat agent from the central part of the UI.
   
   
   
   
2. Describe in your own words how you want the agent to behave; Amazon Quick will use that to automate the setup for you. This step is optional and can be skipped in favour of manual configuration.
3. In the Configure chat agent window, make sure that within Actions, the Qlik MCP integration connection configured in Step 3 of this guide is linked; otherwise, link it manually.
4. Once you're done, click Launch chat agent.
   
   

Step 6: The power of Amazon Quick and the Qlik MCP server in action

Now you're ready to harness the full power of Qlik's trusted Data Products and Analytics Engine within Amazon Quick workflows through the newly created agent. What once required switching between tools can now happen in a single, unified experience.

Troubleshooting

Problem: Non-admin users can't connect
Likely root cause: Tenant admin hasn't completed first connection yet (see note in Step 3)

Problem: OAuth callback fails
Likely root cause: Region placeholder in the redirect URL doesn't match your Quick instance's actual region

Problem: User connects but can't access specific apps or data
Likely root cause: Space permissions or Section Access rules are restricting access; this is by design

Problem: The user is not able to use Qlik tools from the Amazon Quick Chat Agent
Likely root cause: Make sure the Qlik MCP server connection is added to the Chat Agent's available actions

Related Content

• Deploying and administering Qlik MCP server
• Qlik MCP server access and permissions
• Connecting to the Qlik MCP server
• OAuth2 clients Qlik Cloud supports
• Integration demo