We have a QAP system and we have external users A, B and C who are competitors. We have corresponding apps AppA, AppB and AppC for these users, and they should not be able to see each other's data.
These users have their user IDs and passwords in an Excel file and this is set up in QMC correctly.
External user A now wants to get to the data in his AppA using API calls to GetTableData(). I am trying to figure out how to let him in, but only to his app. The first step in my prototype is to authenticate as user A. I thought that certificates may be a way to accomplish this. But the documentation and experimentation doesn't make sense to me. This is what I am reading:
https://help.qlik.com/en-US/sense-developer/November2019/Subsystems/EngineAPI/Content/Sense_EngineAP...
In Example 1 and 2, it seems that if the client provides the certificates and a header that looks like the following, he can assume ANY identity?
headers: { 'X-Qlik-User': 'UserDirectory=internal; UserId=sa_engine' }
Perhaps I am misunderstanding this, but this seems to be me that providing the certificates and this header is sufficient to identify the user as sa_engine or any other user?
Any ideas on how to authenticate external users without them gaining access to all the apps is appreciated. I am open to non-certificate solutions if they work without requiring witchcraft.
