This video will demonstrate how to install and configure Qlik-CLI for SaaS editions of Qlik Sense.

Content:

• Requirements
• Installation method One
• Installation Method Two
• Enable the Completion Feature (optional, but useful)
• Use Qlik-CLI
• Related Content
• Transcript

Requirements

• The user has access to a Qlik Cloud tenant
• The user has a professional license assigned in the tenant
• The user has the developer role assigned (required for API access)
• An API key can be obtained

Installation method One

1. Download Qlik-CLI from GitHub
2. Copy the executable to a local directory
3. Add the Qlik-CLI as an Environment Variable Path. 
   1. Open your Windows Control Panel
   2. Navigate to System 
   3. Open Advanced system settings in the leftmost menu
   4. Click Environment Variables 
   5. Locate Path in the User's System variables 
   6. Click Edit
   7. Click New
   8. Add the path to Qlik-CLI for example C:\Tools\Qlik-QLI\Modify the User Environment. Add path to Qlik-CLI. ie "C:\Tools\Qlik-QLI\"
   9. Confirm with OK until all windows are closed
4. Confirm the Qlik-CLI location path to verify it the installation completed successfully 
   1. Open PowerShell
   2. Execute:
      

      get-command qlik​

   3. Closer PowerShell

Installation Method Two

1. Download and install Chocolatey as documented on chocolatey.org.
2. Open PowerShell
3. Execute:
   

   choco install qlik-cli

4. This completes the installation.

Enable the Completion Feature (optional, but useful)

1. Verify if a PowerShell profile exists or create a new one
   1. Open PowerShell
   2. Execute:
      

      if ( -not (Test-Path $PROFILE) ) {
         echo "" > $PROFILE
      }​

2. Open the profile with the command notepad $PROFILE:
   

   qlik completion ps > "./qlik_completion.ps1" # Create a file containing the powershell completion.
   . ./qlik_completion.ps1                      # Source the completion.​

3. Save it. 
4. Restart PowerShell

Use Qlik-CLI

Advanced and additional instructions as seen in the video can be found at Qlik-CLI on Qlik.Dev. Begin with Get Started.

Customer policy adopted injection via the reverse proxy of the Content Security Policy header for security reasons. 

The policy adopted is basic: default-src 'self'

Opening the QlikView AccessPoint or Qlik Sense Hub may fail or the AccessPoint may only render partially. 

The Browser Debug tools will provide more insight:


 

Environment:

QlikView 
Qlik Sense Enterprise on Windows 

The Header Content Security Option contains a string of rules that informs the browser which resource/code is trusted to be loaded, executed rendered. 

More details on the argument could be found here: 
 https://www.w3.org/TR/CSP3/ ,
 

Resolution:

For QlikView Accesspoint a first example is to use Content-Security-Policy: "default-src 'self'  'unsafe-inline' data: ;" ; (note that using 'unsafe-inline'  option could be unsafe in a the proxy injection scenario when the client will brose a different site , you could/evaluate to use instead the  sha256-hashcode version )  
Further option could be necessary if for example you have QlikView Extension Object ( Server and Document Extensions) that are using external resources downloaded from CDN locations;
In this case the troubleshoot is the same use F12/Development Tools to check the resource that violates the policy and ad an exclusion. 

Related Content:

QlikView Access Point Shows "Loading Content" Indefinitely,
What is CSP (Content-Security-Policy) and How does it Relate to Qlik?


 

This article explains how to get started with the .NET SDK

The following must be installed to test the example provided in this article:

• Microsoft Visual Studio (The community version can be used)
• Qlik Sense Server

*It does not need to be installed on the same machine, but proper ports must be open for incoming connection on the Qlik Sense server side.

Please also make sure that the user connecting from the .NET SDK has a license assigned

Environments:

Resolution:

1. Open Visual Studio and create a new project. In this example, we have selected "Console App (.NET Framework)"
2. Go to Tools > NuGet Package manager > Package Manager Console
3. Use "Install-Package QlikSense.NetSDK" to install the latest version of the SDK or "Install-Package QlikSense.NetSDK -Version x.x.x" to install a specific version (It must match the Qlik Sense server version). Go to https://www.nuget.org/packages/QlikSense.NetSDK/ to find the correct command for your version if you are unsure.
4. Once the package is installed, it will appear in the References for your project. We can create a small program with the following code to connect to the Qlik Sense server and show Product version, OS Name and OS Version.

          In the below program, we are using Windows authentication, so we have to use the AsNtlmUserViaProxy function to specify that we want to use Windows authentication.

// using System, etc. 
using Qlik;
using Qlik.Engine;

namespace ConsoleApp1
{
    class Program
    {
        static void Main(string[] args)
        {
            Uri uri = new Uri("https://qlikserver3.domain.local/");
            ILocation location = Qlik.Engine.Location.FromUri(uri);
            location.AsNtlmUserViaProxy(certificateValidation: false);
            using (var hub = location.Hub())
            {
                Console.WriteLine("Product Version: " + hub.ProductVersion());
                Console.WriteLine("OS Name:    " + hub.OSName());
                Console.WriteLine("OS Version: " + hub.OSVersion());
                Console.WriteLine("Press enter to close...");
                Console.ReadLine();
            }
        }
    }
}

• This should show something like this:

Product Version: 3.2.3
OS Name: WindowsNT
OS Version: 6.2.9200
Press enter to close...

Connect to an app:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using Qlik;
using Qlik.Engine;

namespace ConsoleApp1
{
    class Program
    {
        static void Main(string[] args)
        {
            Uri uri = new Uri("https://qlikserver1.domain.local/");
            ILocation location = Qlik.Engine.Location.FromUri(uri);
            location.AsNtlmUserViaProxy(certificateValidation: false);
            IAppIdentifier appIdentifier = location.AppWithId("03bbedf2-2c45-4e10-bf5a-fded0c21cda8");
            using (var app = location.App(appIdentifier))
            {
                var layout = app.GetAppLayout();
                Console.WriteLine(layout.Title + " [" + app.Type + "]");
                Console.ReadLine();
            }
        }
    }
}

Result:
Test1 [Doc]


Tip: If the program does not run, try to build it and execute the .exe file from the Qlik Sense server. If that works locally from the server itself, it might be that there is a network device that is not allowing the connection or the proper ports are not open.

HTTP Strict Transport Security (HSTS) is an opt-in security enhancement which any web application can support through the use of a special response header. When a supported browser receives this header that browser will prevent any communication sent over HTTP in the future and will redirect all traffic over HTTPS instead. 

More details about HSTS can be found on https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html

Resolution

In Qlik Sense, one can add additional HTTP response headers in the Virtual Proxy configuration to enforce HSTS

1. Open the Qlik Sense QMC
2. In the CONFIGURATION SYSTEM section,  click on Virtual Proxies
3. Select the Virtual Proxy profile for user access and click on Edit
4. Go to the Advanced section and in the field "Additional response headers" 
5. Enter the HSTS configuration setting applicable to your environment. i.e  Strict-Transport-Security: max-age=31536000;includeSubDomains;Preload
   
   
   
   
6. HTTP to HTTPS must be enabled.

For additional information about HTTP to HTTPS redirects, see

• How to: Redirect HTTP to HTTPS in Qlik Sense
• Qlik Community: Qlik Sense redirect HTTP to HTTPS
• and feature request Sense Initial URL redirect to /hub (http)

Sites to Confirm HSTS setup

• https://hstspreload.org/
• https://tools.geekflare.com/hsts-test
• https://dev.ssllabs.com/ssltest/
• https://nvisium.com/blog/2014/04/25/is-your-site-hsts-enabled.html

Gov Site on HSTS  https://https.cio.gov/hsts/

Note: Qlik does NOT support the configuration or implementation of non-Qlik or Operating System related software. The above suggestion is an introduction to this topic, and if it does not work in your particular environment then please reach out internally to your IT team. If you need direct assistance, please contact your Account Owner to discuss purchasing Consulting Services. (see How to Contact the Consulting Team?)

Environment:

Qlik Sense Enterprise on Windows 

This article explains how to simply set up JWT authentication using Qlik Sense default certificates and test it.

Steps:

1. Create a new virtual proxy
   
   This section only explains settings specific to JWT and supposes that you have set up Name, Prefix, Session cookie header name, load balancing nodes and linked a Proxy to the new virtual proxy.
   These are the minimum settings required for a virtual proxy to work correctly. Please refer to the Qlik Sense Online Help "Creating a virtual proxy" as well as Qlik Sense For Administrators - JWT authentication for details.
   
   
   1. In the authentication section, select JWT for authentication
   2. Paste the certificate used to sign/decrypt JWT in "JWT certificate
      
      In this article, we will use the default Qlik Sense certificate located:
      
      Important note: We use Qlik Default certificates for simplicity in this article, in a Production scenario, the customer should create the key material (generate a private/public key pair for JWT signing and verification) that is managed by customer internal security policies.
      
      
   3. Go to C:\ProgramData\Qlik\Sense\Repository\Exported Certificates\.Local Certificates
   4. Open server.pem in a text editor
   5. Copy the content including -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- then paste it in the JWT Certificate field in the QMC > Virtual Proxy configuration.
   6. Choose a value for JWT attribute for user ID and JWT attribute for user directory. That can be anything (except reserved key words for JWT claims) but it must match the values used in the JWT payload section when the JWT is generated.
   7. Apply changes and close.
      
       

      

      
      
      
2. Generate the JWT
   
   In this article, we will directly use the JWT debugger available on https://jwt.io to generate the token. In a real use case, the JWT library corresponding to the programming language used should be used to generate the JWT.
   
   
   1. Open https://jwt.io and go to the debugger
   2. Select RS256 for the algorithm
   3. In the PAYLOAD box, set up your attributes previously set via QMA in Qlik Sense's virtual proxy configuration for the user ID and the user directory. (Note: Swap 'DOMAIN' with the user's directory) 
   4. In the Verify signature, paste server.pem (Certificate) and server_key.pem (Private key) content in the appropriate fields. Those files are both located in C:\ProgramData\Qlik\Sense\Repository\Exported Certificates\.Local Certificates
   5. You can now copy the JWT generated in the left field and test it. This should look like:
      
      
      
      
3. Test the generated JWT
   
   In order to log in with JWT, you need to inject the JWT as a header. There are various extensions available depending on your browser in order to test this.
   
   In this example, we are using Chrome with Modheader.
   
   
   1. Install ModHeader from the Chrome Web Store
   2. Try to go to the hub:
      
                https://{your server name}/{prefix for JWT virtual proxy}/hub/
      
      
   3. You should get a 401 error: "Could not authenticate the request: Expected an authentication header." as no header has been provided.
   4. Go to ModHeader and set the following header:
      
             Header name: Authorization
             Header value: Bearer yourjwt
      
      
      
      
   5.    Reload the page, you should now be logged into the hub correctly.

In order to integrate your solution with Qlik Sense using JWT authentication, you will need to pass in your code the JWT token in the authorization token for the first request to Qlik Sense so that a session is created.

Related Content:

• Using Qlik Sense on Windows Repository API (QRS) with qlik-cli 
• Examples of integration for different purposes are available on the internet:
  https://github.com/qlik-oss/enigma.js/tree/master/examples/authentication/sense-using-jwt

QlikView and Qlik Sense provides the capability to extend presentation capability by creating extension objects.

It is important to note that Qlik only supports the API calls made to the QlikView or Qlik Sense server. Qlik does not directly support 3rd party extension implementations. For issues with 3rd party provided extensions, the primary support channel is the 3rd party extension provider. 

For Qlik to support API-related issues, the script or code must be minimised to show the issue is related to the specific API and not the custom code using the API. This initial troubleshooting and simplification of the script must be done by the extension developer. 

Extensions provided by Qlik employees on Qlik Community are not supported by Qlik. These extension solutions are supported within these communities.  

Extensions developed by Qlik’s partners, including certified Extensions, are supported by the Qlik partner.

A customer should also consider this:

• Extensions are generally not supported by Qlik. Qlik Support can only provide recommendations and general configuration advice for extensions. 
• Extensions should be tested one by one when installing them. This is meant to verify them working and not to break standard functionality. 
• A QlikView or Qlik Sense upgrade might cause conflict with non-compatible extensions. This can lead to Qlik product malfunction. It is recommended to always validate upgrade and extension compatibility in the test environment prior to upgrading the production environment. Any compatibility issues or questions should be reported to the extension provider. 

How to get started with R-Script integration within Qlik Sense

The architecture of the integration at a High-level looks like this:



 

Qlik Sense Advanced Analytics integration is essentially an extension to Qlik Sense’s expression syntax, and as such it can be used in both Chart Expressions, and in Load Script Expressions.
 

With this new capability, we are now able to add syntax to a chart expression that tells Qlik Sense that particular expression should not be evaluated on the Qlik Sense server, but instead, all the information and data needed to calculate that expression should be sent via the server side extension on to the backend R system for calculation.

 After the advanced analytic calculations are completed, the data is sent back to the Qlik Sense Server and to the client for visualization.

Environment:

• Qlik Sense Enterprise on Windows , all versions

Resolution:

This video shows an example of how Qlik Sense connects to an R server for extending expression capabilities in Qlik Sense Apps while offloading the calculations to the R server engine.

Click here for Video Transcript

In order to start displaying a simple "Hello World" in Qlik Sense using a R-Script, we will do the following:

1. Have R & R-studio installed in your system. (RGui included with R for Windows can also be used) R can be downloaded at https://cloud.r-project.org/

2. We need a package in R to extend R functionality to applications via TCP/IP. The package name is "Rserve()"
Install the package using the below command in RStudio GUI:

install.packages('Rserve')

3. Now we need to invoke that library and start Rserve. In order to do so, execute the below scripts:

library(Rserve)
Rserve()

4.The communication method from Sense to R is taken care using gRPC. R is not a supported language in gRPC by default.

So a possible solution for this is to develop a connector in any of the supported languages of gRPC. Qlik provides an open-source connector developed in C# which in turn access Rserve to be able to run R scripts.
qlik-oss/sse-r-plugin
Once you built the connector,  start the SSEtoRserve.exe (ideally on the Rserve server itself)

Note: Qlik Support does not support this plugin directly. Inquiries should be submitted via GitHub under sse-r-plugin - Issues

5. Now we will have to configure the plugin:

For Qlik Sense Desktop June 2019 and up:

Add the following line in the settings.ini file:

SSEPlugin=R,localhost:50051

The settings.ini is located in this location: 

For previous Qlik Sense Desktop:

Add the following line in the settings.ini file:

SSEPlugin=R,localhost:50051

The settings.ini file is located in this location:

For Qlik Sense Enterprise/Server:

a. In the QMC, add a new Analytic Connection.
b. Restart the Qlik Sense Engine service.

Please refer to the screenshot below for creating a new connection.

Note: If the R-Plugin (SSEtoRserve.exe) was installed on the R-Server (where Rserve runs) or another machine, point to that machine name instead of 'localhost'. Also, in multi-node environments with multiple Qlik Sense Engines, even if the plugin was installed on the Central node, make sure to add the Central node's hostname instead of 'localhost' as the other Rim node Engine services need the correct DNS/Netbios name to reach the plugin.



6. Now Open a Qlik Sense App and add a KPI object in the sheet. This can be one of the Apps included with the  plugin itself under <storage path>\sse-r-plugin-master\sense_apps

Note that the example apps also need data connections to be created to the data files included with these apps files in the above location.

7. Otherwise, a new app can be created and any data may be loaded for the SSE example below.

8. For the measure, add the following expression which contains an R-script:

R.ScriptEvalStr('paste(q$firstWord, q$secondWord);', 'Hello' as firstWord, 'World' as secondWord)

9. If everything is configured properly, the R-script shown in bold above should be executed fine and it should display a "Hello World" message.

Understanding the R-script & Function:

R.ScriptEvalStr('paste(q$firstWord, q$secondWord);', Only([First Word]) as firstWord, Only([Second Word]) as secondWord)

Eight script functions are automatically added to the functionality of the plugin. What is needed to be covered on the plugin side to fulfill the functionality is to implement the EvaluateScript rpc function.

The syntax of these functions is: 

<EngineSSEName>.<FunctionName>(Script [,Parameter...])

Where the Script is an R-Script to be evaluated & Parameter is the data sent from Qlik's end.

Here, we use the ScriptEvalStr function which accepts argument of type String & returns a String. The 'paste' function in R concatenates vectors after converting to character. We pass two data fields of type string from Qlik (First Word & Second Word). The R-script then references these data fields through the q dataframe (structure already taken care in R) (q$firstWord and q$secondWord). The script/function finally returns a String back to Qlik Sense.

Related Content:

• Analytic Connections - Qlik Sense for Administrators 
• Script Regular Statements - Load - Qlik Sense on Windows 
• Creating an Advanced Analytics Server in 15 minutes using AWS 
• Qlik Server-Side Extension (SSE) with Analytic Connections 
• Getting Started with Advanced Analytics in Qlik Sense using Python 
• How to call an external / custom function in Qlik Sense? 
• Qlik Sense Analytic Connection (SSE) Error when reloading App 
  
  
   

When using SAML or ticket authentication which started in Qlik Sense June 2019, some users belonging to a big number of groups see the error "Qlik Sense G3 Broker API" on the hub and cannot proceed further.

You may receive the following error when setting up the SAML virtual proxy: cachebust pending 

Environments:

• Qlik Sense Enterprise on Windows 
  All Version
  
  

Resolution/Workaround

The only known workaround in the above versions is to reduce the number of groups sent in the SAML response or ticket request.

The fix for this defect is included in the following versions, but additional steps may be necessary:

All Versions

The default setting will still be a header size of 8192 bytes. The fix adds support for a configurable MaxHttpHeaderSize.

Steps:

1. To configure add it at the top section of the file under [globals] (C:\Program Files\Qlik\Sense\ServiceDispatcher\service.conf)

   [globals]
   LogPath="${ALLUSERSPROFILE}\Qlik\Sense\Log"
   MigrationPort=4545
   (...)
   MaxHttpHeaderSize=65534

2. Once the change is done, save the file and restart the Qlik Service Dispatcher service.

Note: Above value (16384) is an example. You may potentially need to put more depending of the total number of characters of all the AD groups to which the user belongs. The max value is 65534.

Other Related Articles:
https://community.qlik.com/t5/Official-Support-Articles/Error-431-when-trying-to-access-the-Qlik-Sense-Management/ta-p/1789124 

Internal Investigation ID(s):

QB-234.

When using Qlik Sense behind a reverse proxy, environment.user.ip is always the IP of the reverse proxy instead of the end user client.

Environments:

• Qlik Sense Enterprise for Windows

This is a product limitation.

A feature request (SHEND-225) has been logged but there is no information if and when the feature will be implemented yet.

When embedding a sheet in an iFrame, the "full screen" toggle button for Qlik Sense native chart objects is missing. This feature is present at the sheet level in the hub

Full Screen toggle button is available at the sheet level in the hub

The same feature is  missing, once a sheet is added in an iFrame (Single Configurator)

Environment

• Qlik Sense Enterprise (all versions)

Resolution

This is a known limitation.

An improvement task has been created (Jira task VIZ-103) and an idea is available on our Ideation Platform.

To check the current status or to add your vote, head over to the idea: full screen for iframe and embed 

Internal Investigation ID(s):

QB-4967
VIZ-103

Qlik Cloud platform features and APIs rely on rate limits to help provide a predictably pleasant experience for users.

The details of how and when rate limiting works differs between features and not based on customer subscriptions. All customers meet the same API rate limit tiers depending on the API endpoint. See Rate limiting for details.

Examples:

• The List users endpoint has a Tier 1 rate limit
• The Create user endpoint has a Tier 2 rate limit

Environment

• Qlik Cloud

By embedding a chart object to your web application, you will use the following example in the body of the HTML file to set the ui attribute to object,  indicating to qlik-embed that you want to embed a specific visualization from a Qlik Sense application.

[ Fig.1 ]

<qlik-embed
  ui="analytics/chart"
  app-id="<APP_ID>"
  object-id="<CHART_ID>"
></qlik-embed>

Using " ui= analytics/chart" it should correctly render, for instance, a single KPI object, as per the documentation below : https://qlik.dev/extend/extend-qlik-visualizations/supported-charts/

The following error can occurs when trying to render the KPI in your web application:

Failed to load visualization: 'kpi'

This is because the character set is not supported and the only supported one is "utf-8".

Resolution

Apply the following instructions in your HTML file element which enforces utf-8 encoding and solves the issue: 

<meta charset="utf-8"> 

For usage where the encoding cannot be controlled by the user (such as embedding in a tool, e.g. Microsoft Excel ) and this error arises, the customer will have to embed with the "classic/chart" type and the option "iframe=true".

Environment

Qlik Cloud

Related Content 

2.0.1 Add the script configuration for qlik-embed

This article provides step-by-step instructions for implementing Azure AD as an identify provider for Qlik Cloud. We cover configuring an App registration in Azure AD and configuring group support using MS Graph permissions.

It guides the reader through adding the necessary application configuration in Azure AD and Qlik Sense Enterprise SaaS identity provider configuration so that Qlik Sense Enterprise SaaS users may log into a tenant using their Azure AD credentials.

Content:

• Prerequisites
• Helpful vocabulary
• Considerations when using Azure AD with Qlik Sense Enterprise SaaS
• Configure Azure AD
• Create the app registration
• Create the client secret
• Add claims to the token configuration
• Add group claim
• Collect Azure AD configuration information
• Configure Qlik Sense Enterprise SaaS IdP
• Recap
• Addendum
• Related Content (VIDEO)

Prerequisites

• An Microsoft Azure account
• A Microsoft Azure Active Directory instance
• A Qlik Sense Enterprise SaaS tenant
• The BYOIDP feature in your Qlik license is set to YES. Contact customer support to find out if you are entitled to bring your own identity provider to your tenant.

Helpful vocabulary

Throughout this tutorial, some words will be used interchangeably.

• Qlik Sense Enterprise SaaS: Qlik Sense hosted in Qlik’s public cloud
• Microsoft Azure Active Directory: Azure AD
• Tenant: Qlik Sense Enterprise SaaS tenant or instance
• Instance: Microsoft Azure AD
• OIDC: Open Id Connect
• IdP: Identity Provider

Considerations when using Azure AD with Qlik Sense Enterprise SaaS

• Qlik Sense Enterprise SaaS allows for customers to bring their own identity provider to provide authentication to the tenant using the Open ID Connect (OIDC) specification (https://openid.net/connect/)
• Given that OIDC is a specification and not a standard, vendors (e.g. Microsoft) may implement the capability in ways that are outside of the core specification. In this case, Microsoft Azure AD OIDC configurations do not send standard OIDC claims like email_verified. Using the Azure AD configuration in Qlik Sense Enterprise SaaS includes an advanced option to set email_verified to true for all users that log into the tenant.
• The Azure AD configuration in Qlik Sense Enterprise SaaS includes special logic for contacting Microsoft Graph API to obtain friendly group names. Whether those groups originate from an on-premises instance of Active Directory and sync to Azure AD through Azure AD Connect or from creation within Azure AD, the friendly group name will be returned from the Graph API and added to Qlik Sense Enterprise SaaS.

   

Configure Azure AD

Create the app registration

1. Log into Microsoft Azure by going to https://portal.azure.com.
2. Click on the Azure Active Directory icon in the browser Or search for "Azure Active Directory" in the search bar on the top. The overview page for the active directory will appear.
   
   
   
   
3. Click the App registrations item in the menu to the left.
   
   
   
   
4. Click the New registration button at the top of the detail window. The application registration page appears.
   
   
   
   
5. Add a name in the Name section to identify the application. In this example, the name of the hostname of the tenant is entered along with the word OIDC.
   
   
   
   
   
   
6. The next section contains radio buttons for selecting the Supported account types. In this example, the default – Accounts in this organizational directory only – is selected.
   
   
   
   
7. The last section is for entering the redirect URI. From the dropdown list on the left select “web” and then enter the callback URL from the tenant. Enter the URI https://<tenant hostname>/login/callback.
   
   
   

   The tenant hostname required in this context is the original hostname provided to the Qlik Enterprise SaaS tenant.

   
   
   Using the Alias hostname will cause the IdP handshake to fail.
8. Complete the registration by clicking the Register button at the bottom of the page.
   
   
   
   
9. Click on the Authentication menu item on the left side of the screen.
   
   
   
   
10. On the middle of the page, the reference to the callback URI appears. There is no additional configuration required on this page.
    
    

Create the client secret

1. Click on the Certificates and secrets menu item on the left side of the screen.
   
   
   
   
2. In the center of the Certificates and secrets page, there is a section labeled Client secrets with a button labeled New client secret. Click the button.
   
   
   
   
3. In the dialog that appears, enter a description for the client secret and select an expiration time. Click the Add button after entering the information.
   
   
   
   
4. Once a client secret is added, it will appear in the Client secrets section of the page.
   

   Copy the "value of the client secret" and paste it somewhere safe.

   After saving the configuration the value will become hidden and unavailable.
   
   

Add claims to the token configuration

1. Click on the Token configuration menu item on the left side of the screen.
   
   
   
   
2. The Optional claims window appears with two buttons. One for adding optional claims, and another for adding group claims. Click on the Add optional claim button.
   
   
   
   
3. For optional claims, select the ID token type, and then select the claims to include in the token that will be sent to the Qlik Sense Enterprise SaaS tenant. In this example, ctry, email, tenant_ctry, upn, and verified_primary_email are checked. None of these optional claims are required for the tenant identity provider to work properly, however, they are used later on in this tutorial.
   
   
   
   
4. Some optional claims may require adding OpenId Connect scopes from Microsoft Graph to the application configuration. Click the check mark to enable and click Add.
   
   
   
   
5.  The claims will appear in the window.
   
   

Add group claim

1. Click on the API permissions menu item on the left side of the screen.
   
   
   
   
2. Observe the configured permissions set during adding optional claims.
   
   
   
   
3. Click the Add a permission button and select the Microsoft Graph option in the Request API permissions box that appears. Click on the Microsoft Graph banner.
   
   
   
   
4. Click on Delegated permissions. The Select permission search and the OpenId permissions list appears.
   
   
   
   
   

   In the OpenID permissions section, check email, openid, and profile. In the Users section, check user.read.

5. In the Select permissions search, enter the word group. Expand the GroupMember option and select GroupMember.Read.All. This will grant users logging into Qlik Sense Enteprise SaaS through Azure AD to read the group memberships they are assigned.
   
   
   
   
6. After making the selection, click the Add permissions button.
   
   
   
   
7. The added permissions will appear in the list. However, the GroupMember.Read.All permission requires admin consent to work with the app registration. Click the Grant button and accept the message that appears.
   
   
   
   

Failing to grant consent to GroupMember.Read.All may result in errors authenticating to Qlik using Azure AD. Make sure to complete this step before moving on.

Collect Azure AD configuration information

1. Click on the Overview menu item to return to the main App registration screen for the new app. Copy the Application (client) ID unique identifier. This value is needed for the tenant’s idp configuration.
   
   
   
   
2. Click on the Endpoints button in the horizontal menu of the overview.
   
   
   
   
3. Copy the OpenID Connect metadata document endpoint URI. This is needed for the tenant’s IdP configuration.
   
   

Configure Qlik Sense Enterprise SaaS IdP

1. With the configuration complete and required information in hand, open the tenant’s management console and click on the Identity provider menu item on the left side of the screen.
   
   
   
   
2. Click the Create new button on the upper right side of the main panel.
   
   
   
   
3. Select OIDC from the Type drop-down menu item, and select  Microsoft Entra ID (Azure AD) from the Provider drop-down menu item.
   
   
   
   
4. Scroll down to the Application credentials section of the configuration panel and enter the following information:
   1. ADFS discovery URL: This is the endpoint URI copied from Azure AD.
   2. Client ID: This is the application (client) id copied from Azure AD.
   3. Client secret: This is the value copy and pasted to a safe location from the Certificates & secrets section from Azure AD.
   4. The Realm is an optional value used if you want to enter what is commonly referred to as the Active Directory domain name.
      
      
      
      
5. Scroll down to the Claims mapping section of the configuration panel. There are five textboxes to confirm or alter.
   
   
   
   
   1. The sub field is the subject of the token sent from Azure AD. This is normally a unique identifier and will represent the UserID of the user in the tenant. In this example, the value “sub” is left and appid is removed. To use a different claim from the token, replace the default value with the name of the desired attribute value.
      
      
      
      
   2. The name field is the “friendly” name of the user to be displayed in the tenant. For Azure AD, change the attribute name from the default value to “name”.
      
      
      
      
   3. In this example, the groups, email, and client_id attributes are configured properly, therefore, they do not need to be altered.
      
      
      

      In this example, I had to change the email claim to upn to obtain the user's email address from Azure AD. Your results may vary.

      
      
      
      
6. Scroll down to the Advanced options and expand the menu. Slide the Email verified override option ON to ensure Azure AD validation works. Scope does not have to be supplied.
   
   
   
   
7. The Post logout redirect URI is not required for Azure AD because upon logging out the user will be sent to the Azure log out page.
8. Click the Save button at the bottom of the configuration to save the configuration. A message will appear confirming intent to create the identity provider. Click the Save button again to start the validation process.
   
   
   
   
9. The validation procedure begins by redirecting the person configuring the IdP to the login page for the IdP.
   
   
   
   
10. After successful authentication, Azure AD will confirm that permission should be granted for this user to the tenant. Click the Accept button.
    
    
    
    
11. If the validation fails, the validation procedure will return a window like the following.
    
    
    
    
12. If the validation succeeds, the validation procedure will return a mapped claims window. If the validation states it cannot map the user's email address, it is most likely because the email_verified switch has not been turned on. Go ahead and confirm, move through the remaining steps, and update the configuration as per the previous step. Re-run the validation to map the email.
    
    
    
    
13. After confirming the information is correct, the account used to validate the IdP may be elevated to a TenantAdmin role. It is strongly recommended to do make sure the box is checked before clicking continue.
    
    
    
    
14. The next to last screen in the configuration will ask to activate the IdP. By activating the Azure AD IdP in the tenant, any other identity providers configured in the tenant will be disabled.
    
    
    
    
15. Success.
    
    
    
    
16. Please log out of the tenant and re-authenticate using the new identity provider connection. Once logged in, change the url in the address bar to point to https://<tenanthostname>/api/v1/diagnose-claims. This will return the JSON of the claims information Azure AD sent to the tenant. Here is a slightly redacted example.
    
    
    
    
17. Verify groups resolve properly by creating a space and adding members. You should see friendly group names to choose from.
    
    
    
    
    
    
    
    

Recap

While not hard, configuring Azure AD to work with Qlik Sense Enterprise SaaS is not trivial. Most of the legwork to make this authentication scheme work is on the Azure side. However, it's important to note that without making some small tweaks to the IdP configuration in Qlik Sense you may receive a failure or two during the validation process.

Addendum

For many of you, adding Azure AD means you potentially have a bunch of clean up you need to do to remove legacy groups. Unfortunately, there is no way to do this in the UI but there is an API endpoint for deleting groups. See Deleting guid group values from Qlik Sense Enterprise SaaS for a guide on how to delete groups from a Qlik Sense Enterprise SaaS tenant.

Related Content (VIDEO)

Qlik Cloud: Configure Azure Active Directory as an IdP

An extension previously deployed successfully in a Qlik Sense on-premise environment has stopped working after being imported to Qlik Cloud Analytics.

The error Invalid visualization is shown in the Qlik Sense app.

The browser debug tools may display an error similar to:

Failed to load resource: the server responded with a status of 404

All required files (see Managing Extensions and Visualization extensions for details) are included in the uploaded zip file. 

Resolution

Change all file names in the extension .zip file to lowercase. Qlik Cloud Analytics tenants handle extensions differently than Qlik Sense on-premise. It is case-sensitive when reading files. 

Cause

The Qlik Cloud Analytics tenant could not find the missing JSON file in the file extension .zip due to case-sensitivity.

Related Content

• Managing Extensions
• Visualization extensions

Environment

• Qilk Cloud Analytics

Snowflake supports using key pair authentication for enhanced authentication security as an alternative to basic authentication (i.e. username and password). This article covers end-to-end setup for Key Pair Authentication in Snowflake and Qlik Replicate.

This authentication method requires, at minimum, a 2048-bit RSA key pair. You can generate the Privacy Enhanced Mail (i.e. PEM) private-public key pair using OpenSSL.

Qlik Replicate will use the ODBC driver to connect snowflake and ODBC is one of the supported clients which will support key pair authentication.

Let's assume, you decided to use key pair authentication for the Snowflake user which is used in Qlik Replicate to connect to Snowflake. You have to follow the below process to convert user authentication from basic to key pair.

Step 1: Generate the Private Key

You can generate either an encrypted version of the private key or an unencrypted version of the private key.

To generate an unencrypted version use the following command in the command prompt:

$ openssl genrsa 2048|openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt

To generate an encrypted version (which omits -nocrypt) use:

$ openssl genrsa 2048|openssl pkcs8 -topk8 -v2 des3 -inform PEM -out rsa_key.p8

In our example case, we generate an encrypted version of a private key.

We:

1. Open a command prompt
2. Run $ openssl genrsa 2048|openssl pkcs8 -topk8 -v2 des3 -inform PEM -out rsa_key.p8
3. Enter our password
4. And store the password to use in Qlik Replicate.

This generates a private key in PEM format:

Step 2: Generate a Public Key

From the command line, we generate the public key by referencing the private key. The following command assumes the private key is encrypted and contained in the file named rsa_key.p8.

When it requests a passphrase, use the same password that we generated in step 1.

openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

This command generates the public key in PEM format:

Step 3: Store the Private and Public Keys Securely

Copy the public and private key files to a local directory for storage and record the path to the files. Note that the private key is stored using the PKCS#8 (Public Key Cryptography Standards) format and is encrypted using the passphrase you specified in the previous step.

However, the file should still be protected from unauthorized access using the file permission mechanism provided by your operating system. It is your responsibility to secure the file when it is not being used.

Step 4: Assign the Public Key to a Snowflake User

Describe the user to see current information. We can see that there is no public key assigned to the HDW user. Therefore, the user needs to use basic authentication.

Execute an ALTER USER command to assign the public key to a Snowflake user.

Step 5: Verify the User’s Public Key Fingerprint

Execute a DESCRIBE USER command to verify the user’s public key.

Step 6: Configure Qlik Replicate to Use snowflake Key Pair Authentication

1. Enter the snowflake server name and the username that we configured key pair authentication.
   
   
   
   
2. We need to set the below parameters to set the authentication method as SNOWFLAKE_JWT, passing the private key and password from step 1.
   
   
   
   
3. Try to do the test connection\browse the database and you can see a missing password error. We can't ignore the password in the endpoint UI and at the same time, we shouldn't enter the password as we are using keypair authentication.
   
   
   
   
4. You can key in a dummy password, such as dummy, dummy123, etc., in the UI to eliminate the missing password error.
   
   Finally, browse the database and do the test connection.
   
   

Environment

Qlik Replicate 
Snowflake Target

 Google Workspace can be used as a SAML identify Provider for Qlik Sense Enterprise on Windows, facilitating a single sign-on solution. In this article, we will cover how to perform a quick setup using Qlik Sense Enterprise on Windows September 2020.

Prepare the SAML App in Google Marketplace.

1. Log on to your Google Marketplace Admin console
2. Open Apps 
   
   

    

   
   
   
3.  From the list of available Applications, select SAML Apps
   
   
4.  Click Add App 
5. Choose Add custom SAML app
   
   
   
   
6.  Choose an App name.
   We are using Qlik Sense as the App name.
7. Click Continue
   
   
   
   
8.  Click DOWNLOAD METADATA and CONTINUE.
   
   

    

9. The download provides you with a GoogleIDPMetadata.XML file. Copy this file to your Qlik Sense Enterprise on Windows host machine. 

Setting up SAML

To begin setting up SAML, we need to set up a new Virtual Proxy. 

1. Open the Qlik Sense Management Console
2. In the menu to the left, locate Virtual Proxies 
3. In the Virtual Proxies setup, click Create new
   
   
   
   
4. Select Identification, Authentication, Load balancing, and Advanced  in the Properties menu on the right. 
   
   

    

5. Populate the Virtual Proxy fields. Our example follows below, including short descriptions. 
   1. We begin with the Identification settings
   2. Description: SAML
      This is the description of the Virtual Proxy.
   3. Prefix: saml
      This value needs to be unique across all your Virtual Proxies. Note the character restrictions as documented in the visual guide. 
   4. Session cookie header name: X-Qlik-saml
      The cookie header name must be unique across all your virtual proxies used by the same proxy service. 
   5. We move on to the Authentication settings.
   6. Anonymous access mode: No anonymous user
   7. Authentication method: SAML
      This is where we choose what module the Virtual Proxy uses
   8. SAML single logout checkbox
      We leave this unticked. Our IdP metadata file does not include a logout URL.
   9. SAML host URI: https://qlikserver2.domain.local/
      This is our Qlik Sense Proxy URL. You will need this URL for the remaining SAML setup in Google Workspace. 
   10. SAML entity ID: GoogleSAML
       This is the entity ID that we choose. You will need this ID for the remaining SAML setup in Google Workspace. 
   11. SAML idP metadata: Upload the GoogleIDPMetadata.xml file.
   12. SAML attribute for userID: email
       Choose what attribute to use for the userID. We choose email. 
   13. SAML attribute for user directory: [DOMAIN]
       The static attribute must be enclosed in brackets. We choose DOMAIN
   14. SAML signing algorithm: SHA-1
       We leave this unchanged.
   15. Move on to the Load Balancing settings and click Add new server node to choose the Engine nodes the Virtual Proxy should be using. 
   16. We move on to the Advanced settings
   17. These depend on your setup. We choose to use Lax SameSite attribute (https)
       
       

        

   18. Add any required hosts to the Host white list 
       These are the names or IP addresses your users use to connect to the Virtual Proxy with. Eg: domainname.com or machinename.domain.com.
   19. Click Apply 
   20. You will be alerted that the Proxy Services associated with this Virtual Proxy will restart
   21. Now we will associate a Proxy to the Virtual Proxy. You will notice a new menu available in the right-hand corner: Associated items - Proxies
       
   22. Click Proxies 
   23. Click Link
   24. Follow the on-screen instructions to link the Proxy
       
       

        

   25. The Proxy will restart.
   26. Return to the Virtual Proxies overview and select your SAML virtual proxy 
   27. In the menu at the bottom of the screen click Download SP metadata
       This will give you a saml_metadata_sp.xml including the remaining details you need for the setup.
       
       

Finalizing the SAML Setup in Google Workspace

1. Return to your SAML App in Google Workspace. We will be filling out the bare minimum. Depending on your requirements, this may vary. Our examples are shown below.
2. Based on the information in your saml_metadata_sp.xml and settings, fill out:
   1. ACS URL: https://qlikserver2.domain.local:443/saml/samlauthn/
   2. Entity ID: GoogleSAML
   3. Signed response is not supported in Qlik Sense. 
   4. Name ID format: EMAIL
   5. Name ID: Basic Information > Primary eMail
      
      
3. Click Continue
4. Click Add mapping and fill out the Attributes 
   Note that these are case sensitive. We used email in Qlik Sense, so we do the same here.
   
   

    

5. Click Finish
   
   
   

This concludes the setup!

To test, access the Qlik Sense hub using the prefix defined in the setup. In our case, the URL is: https://qlikserver2.domain.local/saml

You will be redirected to a Google Account signing page.