We have been piloting Qlik Sense over the past months. Ideally want to transfer all QlikView models to Sense. But because of this mobile access problem we are close to abandoning that.
My company only allows connection to internal servers via Citrix Mobile Secure Web browser. I can successfully connect to QMC through that. However, when trying to reach hub it gives 'Internal Server Error'. Our local Qlik consultants say "there might be a gateway problem" and nothing else. Has anyone ever came across this case or knows how to indentify the route cause using logs. I'd be willing to share them. I really like QLik Sense and hate to abandon it because of an unknown. Krs.
Connectivity test seems to confirm that there is websocket issue. How may I find out what is blocking websockets?
Someone suggested Citrix requires secure SSL for websocket to work -- could that be the case?
nOpe! we tried "Digicert SHA2 High Assurance Server CA" secure SSL certification (the same certificate in official qlik sense demo site. -- which actually works in our system.) the result is no.
apparently certification has nothing to do with our case here
Diagnosis of mobile connectivity problems needs to begin with determining whether the browser is websocket-capable at all. There are known problems with Apple's WKWebView component on older versions of iOS. Browse to http://websocketstest.com/ using several different browsers to see if they produce a consistent response. Then try to access the public Qlik Sense websocket diagnostic at https://sense-demo.qlik.com/content/default/QlikSenseWebsocketTest.html and open sample Qlik Sense documents at https://demos.qlik.com/qliksense
According to https://docs.citrix.com/en-us/xenapp-and-xendesktop/current-release/downloads/secure-browser-deploym... it appears that the Citrix Secure Web browser can be websocket-enabled satisfactorily.
When using a mobile browser to interact with a private instance of Qlik Sense the browser will interact with a VPN gateway or Proxy to reach Qlik Sense. In a Citrix environment the Netscaler Gateway must be configured to support long-duration websocket connections. This may be confirmed by deploying the diagnostic content from http://branch.qlik.com/#!/project/56728f52d1e497241ae69865 into the Qlik Sense Content Library, then accessing it with a browser - compare the response with those produced by the public example above. Note that the QMC does not require websockets, so it will almost certainly work. The older QlikView product is also not dependent on websockets. Problems may arise upon opening a Qlik Sense document from the Hub, when websocket connections are established for querying the Qlik Associative Engine. While waiting for the websocket connection to be established you are shown the 'raindrops' animation which may eventually timeout.
If there are isssues with the SSL Certificate on the Qlik Sense Proxy (eg the issuing Certificate Authority is not recognised and trusted on the mobile device) then you probably wouldn't be able to access the Hub or QMC without errors, and certainly wouldn't be able to establish a satisfactory websocket connection. The Qlik Sense Proxy (which delivers the Hub and QMC) can be configured to support non-secure http (ws) connections in addition to https (wss), which may be an option if you have SSL Certificate trust problems. Basically, if you want to use https then mobile devices require a good implementation of SSL, but Qlik Sense itself does not require https.
The websocket (ws/wss) connection that is used for querying data from the Qlik Associative Engine must also carry Session Cookies in it that are used to provide identity and are used for data authorisation and reduction in the Qlik engine. It's possible that a websocket connection fails (and produces an Engine Error) if the cookies are missing/truncated.
The most likely place that a problem will be in a Citrix deployment is with the configuration of the Netscaler appliance. Seek assistance from the Netscaler administrators regarding SSL Certificate trust, enablement of websockets (a standard feature of HTML5 absolutely required by Qlik Sense), sizing of any websocket connection pool, and duration of idle connections.
I shared this recommendation to relevant IT folks. They investigated and "enabled WebSocket connections" in the Netscaler settings. However that still didn't help!
They suggested installing the app inside Citrix Secure Hub. But unfortunately Qlik is not sharing the .ipa file. So I think we are stuck in the direction.
It is futile to consider deploying or testing the iOS "Qlik Sense Mobile" (QSM) app in this environment until after browser connectivity has been proven. QSM uses the same connectivity protocols to interact with Qlik Sense Enterprise in the online use-case as a browser would use.
Have you deployed the Websocket Diagnostic from Qlik Branch into your Qlik Sense server, then accessed this content using Citrix Mobile Secure Web browser? How does the output compare with corresponding publicly accessible content at https://sense-demo.qlik.com/content/default/QlikSenseWebsocketTest.html
Qlik may share the Unsigned IPA on approval from the Product Manager, but in your case you'll need to prove basic connectivity from a browser first as the Netscaler will interfere equally with operation of both browsers and QSM.