Qlik Community

Qlik NPrinting Discussions

Discussion Board for collaboration on Qlik NPrinting.

Announcements
IMPORTANT security patches for GeoAnalytics Server available to download: READ DETAILS
cancel
Showing results for 
Search instead for 
Did you mean: 
Diane
Partner
Partner

[NPrinting] Section access with Qlik Sense in SAML in Nprinting

Hello,
For a customer we need to implement NPrinting for QlikSense.
Currently users connect to Qlik Sense in SAML and use access sections for security.
Do you know if the access sections are well taken into account by NPrinting when the authentication to Qlik Sense is done by SAML.
Are there any particular prerequisites?

Thanks in advance

Labels (2)
1 Solution

Accepted Solutions
Ruggero_Piccoli
Support
Support

Hi @Diane ,

Yes, you use SAML to connect to Qlik NPrinting Web Console (for administrative tasks like creating connection, editing reports, etc) and NewsStand (for non admin or designer users) to read the reports.

To connect Qlik NPrinting to Qlik Sense you need to fill the requirements https://help.qlik.com/en-US/nprinting/May2021/Content/NPrinting/DeployingQVNprinting/NPrinting-with-... so the user that runs the Qlik NPrinting Engine Windows user must be a domain account.

About section access I have not understood if you already had implemented it in Qlik Sense. If not I suggest to create Qlik NPrinting native filters and associate them with Qlik NPrinting users instead of implementing section access because the generation of the reports with filters is faster than with section access. Section access is supported and yes you must use NTLM so you need to define section access in Qlik Sense and associate the domain user to each Qlik NPrinting user. 

About the publication on Qlik Sense Hub https://help.qlik.com/en-US/nprinting/May2021/Content/NPrinting/AdministeringQVNprinting/Hub-destina... "You can distribute Qlik NPrinting reports to the Qlik Sense hub for Windows domain users who have been configured in both Qlik NPrinting and Qlik Sense." so "Recipients must be Windows domain users configured in both Qlik NPrinting and Qlik Sense.", it is a requirement. 

On-Demand for Qlik sense users must be logged into Qlik Sense via NTML (Windows) authentication in order to generate reports or create reporting buttons. Qlik NPrinting uses the identity of the user logged in Qlik Sense https://help.qlik.com/en-US/nprinting/May2021/Content/NPrinting/On-Demand/Create-Report-On-Demand-QS...

Yes, the account in Qlik NPrinting connection to Qlik Sense app you need to use a domain account and Qlik NPrinting and Qlik Sense must be in the same domain https://help.qlik.com/en-US/nprinting/May2021/Content/NPrinting/GettingStarted/HowCreateConnections/...

Best Regards,

Ruggero

 



Best Regards,
Ruggero
---------------------------------------------
When applicable please mark the appropriate replies as CORRECT. This will help community members and Qlik Employees know which discussions have already been addressed and have a possible known solution. Please mark threads with a LIKE if the provided solution is helpful to the problem, but does not necessarily solve the indicated problem. You can mark multiple threads with LIKEs if you feel additional info is useful to others.

View solution in original post

5 Replies
Lucas_Gatling
Support
Support

Hello Diane,

 

Please see the below links.

 

About SAML refer to https://help.qlik.com/en-US/nprinting/November2020/Content/NPrinting/DeployingQVNprinting/SAML.htm it lists also the limitations. 

On-Demand with Qlik Sense requires NTML authentication as listed in https://help.qlik.com/en-US/nprinting/November2020/Content/NPrinting/On-Demand/Create-Report-On-Dema....

Limitations on accessing the NewsStand depend on the security roles you assign to the user https://help.qlik.com/en-US/nprinting/November2020/Content/NPrinting/DeployingQVNprinting/Security-m.... For example if you give to a user the built in "NewsStand User" role the user can do everything in the NewsStand with reports from all Qlik NPrinting apps. You can also create your custom roles for example to give to a user only the right to view the NewsStand reports. 

Section access is supported with the details listed in https://help.qlik.com/en-US/nprinting/November2020/Content/NPrinting/DeployingQVNprinting/Section-ac.... To create a connection that uses section access you can follo the instructions in https://help.qlik.com/en-US/nprinting/November2020/Content/NPrinting/GettingStarted/HowCreateConnect...

 

Hopefully this these will help answer your questions

If the issue is solved please mark the answer with Accept as Solution.
Ruggero_Piccoli
Support
Support

Hi,

SAML is used to login users in Qlik NPrinting not to connect Qlik NPrinting with Qlik Sense. To use section access you must configure the domain user in each Qlik NPrinting user. They are two different things.

For your version of Qlik NPrinting SAML is documented in https://help.qlik.com/en-US/nprinting/May2021/Content/NPrinting/DeployingQVNprinting/SAML.htm. Instead section access is in https://help.qlik.com/en-US/nprinting/May2021/Content/NPrinting/DeployingQVNprinting/Section-access....

Best Regards,

Ruggero



Best Regards,
Ruggero
---------------------------------------------
When applicable please mark the appropriate replies as CORRECT. This will help community members and Qlik Employees know which discussions have already been addressed and have a possible known solution. Please mark threads with a LIKE if the provided solution is helpful to the problem, but does not necessarily solve the indicated problem. You can mark multiple threads with LIKEs if you feel additional info is useful to others.
LTIAT95
Partner
Partner

Hi @Ruggero_Piccoli  I'm  working on the similar implementation of SSO between Qlik NPrinting and Oracle IDAM (OAM) and I keep greeting the Error :  No matching route found: /

I noticed the Qlik NPrinting doesn't have the Certificate included in Metadata. 

Below is the Metadata from my NPrinting box.

 

<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="SSO" ID="_7f8f0dac-c00a-4a07-b03f-d89cc010243b">
<md:SPSSODescriptor ID="_2e70fe42-d705-0000-a7da-87b3ea0d1564" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" AuthnRequestsSigned="false" WantAssertionsSigned="true">
<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://myserver.domain.com:4993/login/saml/SSO" index="0" isDefault="true"/>
</md:SPSSODescriptor>
</md:EntityDescriptor>
 
any help or suggestion? Not sure if I'm missing anything here.
Diane
Partner
Partner
Author

Hi Ruggero and Lucas,

If I understand correctly, we can connect in SAML on console NPrinting to create filters, publication tasks, .... and on the NewStand to view NPrinting reports
But as soon as NPrinting has to communicate with Qlik Sense it no longer recognizes the accounts defined in the IdP but only recognizes Windows accounts.
In this case :
- for the access section: we have to create windows accounts for the users and define these accounts in the access section and in NPrinting.
- for the publication in the Qlik Sense hub: impossible for users having their Qlik Sense rights on their SAML account
- on-demand is not possible if the user is connected with SAML authentication on Qlik Sense
- the accounts used in Nprinting connections must be Windows accounts.

Is this correct?

Thanks in advance

Ruggero_Piccoli
Support
Support

Hi @Diane ,

Yes, you use SAML to connect to Qlik NPrinting Web Console (for administrative tasks like creating connection, editing reports, etc) and NewsStand (for non admin or designer users) to read the reports.

To connect Qlik NPrinting to Qlik Sense you need to fill the requirements https://help.qlik.com/en-US/nprinting/May2021/Content/NPrinting/DeployingQVNprinting/NPrinting-with-... so the user that runs the Qlik NPrinting Engine Windows user must be a domain account.

About section access I have not understood if you already had implemented it in Qlik Sense. If not I suggest to create Qlik NPrinting native filters and associate them with Qlik NPrinting users instead of implementing section access because the generation of the reports with filters is faster than with section access. Section access is supported and yes you must use NTLM so you need to define section access in Qlik Sense and associate the domain user to each Qlik NPrinting user. 

About the publication on Qlik Sense Hub https://help.qlik.com/en-US/nprinting/May2021/Content/NPrinting/AdministeringQVNprinting/Hub-destina... "You can distribute Qlik NPrinting reports to the Qlik Sense hub for Windows domain users who have been configured in both Qlik NPrinting and Qlik Sense." so "Recipients must be Windows domain users configured in both Qlik NPrinting and Qlik Sense.", it is a requirement. 

On-Demand for Qlik sense users must be logged into Qlik Sense via NTML (Windows) authentication in order to generate reports or create reporting buttons. Qlik NPrinting uses the identity of the user logged in Qlik Sense https://help.qlik.com/en-US/nprinting/May2021/Content/NPrinting/On-Demand/Create-Report-On-Demand-QS...

Yes, the account in Qlik NPrinting connection to Qlik Sense app you need to use a domain account and Qlik NPrinting and Qlik Sense must be in the same domain https://help.qlik.com/en-US/nprinting/May2021/Content/NPrinting/GettingStarted/HowCreateConnections/...

Best Regards,

Ruggero

 



Best Regards,
Ruggero
---------------------------------------------
When applicable please mark the appropriate replies as CORRECT. This will help community members and Qlik Employees know which discussions have already been addressed and have a possible known solution. Please mark threads with a LIKE if the provided solution is helpful to the problem, but does not necessarily solve the indicated problem. You can mark multiple threads with LIKEs if you feel additional info is useful to others.