[NPrinting] Section access with Qlik Sense in SAML in Nprinting

[Diane]

Hello,
For a customer we need to implement NPrinting for QlikSense.
Currently users connect to Qlik Sense in SAML and use access sections for security.
Do you know if the access sections are well taken into account by NPrinting when the authentication to Qlik Sense is done by SAML.
Are there any particular prerequisites?

Thanks in advance

[Lucas_Gatling]

Hello Diane,

Please see the below links.

About SAML refer to https://help.qlik.com/en-US/nprinting/November2020/Content/NPrinting/DeployingQVNprinting/SAML.htm it lists also the limitations. 

On-Demand with Qlik Sense requires NTML authentication as listed in https://help.qlik.com/en-US/nprinting/November2020/Content/NPrinting/On-Demand/Create-Report-On-Dema....

Limitations on accessing the NewsStand depend on the security roles you assign to the user https://help.qlik.com/en-US/nprinting/November2020/Content/NPrinting/DeployingQVNprinting/Security-m.... For example if you give to a user the built in "NewsStand User" role the user can do everything in the NewsStand with reports from all Qlik NPrinting apps. You can also create your custom roles for example to give to a user only the right to view the NewsStand reports. 

Section access is supported with the details listed in https://help.qlik.com/en-US/nprinting/November2020/Content/NPrinting/DeployingQVNprinting/Section-ac.... To create a connection that uses section access you can follo the instructions in https://help.qlik.com/en-US/nprinting/November2020/Content/NPrinting/GettingStarted/HowCreateConnect...

Hopefully this these will help answer your questions

[Ruggero_Piccoli]

Hi,

SAML is used to login users in Qlik NPrinting not to connect Qlik NPrinting with Qlik Sense. To use section access you must configure the domain user in each Qlik NPrinting user. They are two different things.

For your version of Qlik NPrinting SAML is documented in https://help.qlik.com/en-US/nprinting/May2021/Content/NPrinting/DeployingQVNprinting/SAML.htm. Instead section access is in https://help.qlik.com/en-US/nprinting/May2021/Content/NPrinting/DeployingQVNprinting/Section-access....

Best Regards,

Ruggero

[LTIAT95]

Hi @Ruggero_Piccoli  I'm  working on the similar implementation of SSO between Qlik NPrinting and Oracle IDAM (OAM) and I keep greeting the Error :  No matching route found: /

I noticed the Qlik NPrinting doesn't have the Certificate included in Metadata. 

Below is the Metadata from my NPrinting box.

<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="SSO" ID="_7f8f0dac-c00a-4a07-b03f-d89cc010243b">

<md:SPSSODescriptor ID="_2e70fe42-d705-0000-a7da-87b3ea0d1564" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" AuthnRequestsSigned="false" WantAssertionsSigned="true">

<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>

<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://myserver.domain.com:4993/login/saml/SSO" index="0" isDefault="true"/>

</md:SPSSODescriptor>

</md:EntityDescriptor>

any help or suggestion? Not sure if I'm missing anything here.

[Diane]

Hi Ruggero and Lucas,

If I understand correctly, we can connect in SAML on console NPrinting to create filters, publication tasks, .... and on the NewStand to view NPrinting reports
But as soon as NPrinting has to communicate with Qlik Sense it no longer recognizes the accounts defined in the IdP but only recognizes Windows accounts.
In this case :
- for the access section: we have to create windows accounts for the users and define these accounts in the access section and in NPrinting.
- for the publication in the Qlik Sense hub: impossible for users having their Qlik Sense rights on their SAML account
- on-demand is not possible if the user is connected with SAML authentication on Qlik Sense
- the accounts used in Nprinting connections must be Windows accounts.

Is this correct?

Thanks in advance

[Ruggero_Piccoli · Accepted solution]

Hi @Diane ,

Yes, you use SAML to connect to Qlik NPrinting Web Console (for administrative tasks like creating connection, editing reports, etc) and NewsStand (for non admin or designer users) to read the reports.

To connect Qlik NPrinting to Qlik Sense you need to fill the requirements https://help.qlik.com/en-US/nprinting/May2021/Content/NPrinting/DeployingQVNprinting/NPrinting-with-... so the user that runs the Qlik NPrinting Engine Windows user must be a domain account.

About section access I have not understood if you already had implemented it in Qlik Sense. If not I suggest to create Qlik NPrinting native filters and associate them with Qlik NPrinting users instead of implementing section access because the generation of the reports with filters is faster than with section access. Section access is supported and yes you must use NTLM so you need to define section access in Qlik Sense and associate the domain user to each Qlik NPrinting user. 

About the publication on Qlik Sense Hub https://help.qlik.com/en-US/nprinting/May2021/Content/NPrinting/AdministeringQVNprinting/Hub-destina... "You can distribute Qlik NPrinting reports to the Qlik Sense hub for Windows domain users who have been configured in both Qlik NPrinting and Qlik Sense." so "Recipients must be Windows domain users configured in both Qlik NPrinting and Qlik Sense.", it is a requirement. 

On-Demand for Qlik sense users must be logged into Qlik Sense via NTML (Windows) authentication in order to generate reports or create reporting buttons. Qlik NPrinting uses the identity of the user logged in Qlik Sense https://help.qlik.com/en-US/nprinting/May2021/Content/NPrinting/On-Demand/Create-Report-On-Demand-QS...

Yes, the account in Qlik NPrinting connection to Qlik Sense app you need to use a domain account and Qlik NPrinting and Qlik Sense must be in the same domain https://help.qlik.com/en-US/nprinting/May2021/Content/NPrinting/GettingStarted/HowCreateConnections/...

Best Regards,

Ruggero