Supported Mobile Clients and EMM Suites

[MichaelRobertshaw]

Supported Mobile Clients and EMM Suites Requirements

Browser connectivity to Qlik Sense requires that the Browser, VPN, and all Network Infrastructure between the Mobile Device and Qlik Sense Enteprise supports HTML5 Websockets. Some components may require tuning to ensure that the long-duration websockets Qlik uses are not inappropriately terminated due to inactivity.

1. On iOS the browser must use Apple's newer WKWebView rendering engine. Older browsers that still use the now-deprecated UIWebView rendering engine do not support the HTML Stylesheets that Qlik Sense uses, and may not display all content correctly. UIWebView may also fail to route websocket traffic correctly through Per App VPN to on-premise instances of Qlik Sense Enterprise.
2. Test websocket connectivity by deploying QlikSenseWebSocketTest.html from https://github.com/flautrup/QlikSenseWebsocketConnectivityTester into the Qlik Sense Content Library, then access with a mobile browser and compare results to the public content at https://sense-demo.qlik.com/content/default/QlikSenseWebsocketTest.html 
3. In rare cases it may be necessary to configure Qlik Sense to keep idle websockets alive, otherwise network infrastructure may terminate those connections to the Associative Engine during user inactivity. Refer https://support.qlik.com/articles/000055708 

Qlik Sense Mobile additionally requires that the VPN Client supports Split Tunneling so that localhost TCP traffic within the app is not inappropriately routed to the VPN Server. This functionality is broken in iOS 13.0-13.3, so 13.4+ is strongly recommended.

1. supported with AirWatch as per help.qlik.com
2. supported with MobileIron Tunnel v4.0 as per Document
3. supported with Azure AD Application Proxy

Support Matrix

This information is correct as at May 2020.

Client OS	Client	No EMM	Microsoft Intune/Azure	VMware AirWatch (1)	MobileIron (2)	BlackBerry Dynamics	PulseSecure (3)	IBM MaaS360	Citrix XenMobile (4)
iOS	Qlik Sense Mobile	Supported	Supported	Supported	Supported	Not Applicable	Not Tested	Not Tested	Not Tested
Android	Qlik Sense Mobile for Android	Supported	Supported	Supported	Supported	Not Applicable	Not Tested	Not Tested	Not Tested
iOS	Qlik Sense Mobile for BlackBerry	Not Applicable	Not Applicable	Not Applicable	Not Applicable	Supported	Not Applicable	Not Applicable	Not Applicable
iOS	Safari	Supported	Supported	Supported	Supported	Not Applicable	Not Tested	Not Tested	Not Tested
iOS	Chrome	Supported	Supported	Supported	Supported	Not Applicable	Not Tested	Not Tested	Not Tested
iOS	Workspace ONE Web	Not Applicable	Not Applicable	Supported	Not Applicable	Not Applicable	Not Applicable	Not Applicable	Not Applicable
iOS	MobileIron Web@Work	Not Applicable	Not Applicable	Not Applicable	Supported	Not Applicable	Not Applicable	Not Applicable	Not Applicable
iOS	BlackBerry Access	Not Applicable	Not Applicable	Not Applicable	Not Applicable	Supported	Not Applicable	Not Applicable	Not Applicable
iOS	Microsoft Edge	Not Tested	Not Tested	Not Tested	Not Tested	Not Applicable	Not Tested	Not Tested	Not Tested
iOS	UponBI	Works	Works	Works	Works	Not Applicable	Not Tested	Not Tested	Not Tested
iOS	Citrix Secure Web	Not Applicable	Not Applicable	Not Applicable	Not Applicable	Not Applicable	Not Applicable	Not Applicable	Does Not Work
Android	Chrome	Supported	Supported	Supported	Supported	Not Applicable	Not Tested	Not Tested	Not Tested
Android	Workspace ONE Web	Not Applicable	Not Applicable	Supported	Not Applicable	Not Applicable	Not Applicable	Not Applicable	Not Applicable
Android	MobileIron Web@Work	Not Applicable	Not Applicable	Not Applicable	Not Tested	Not Applicable	Not Applicable	Not Applicable	Not Applicable
Android	BlackBerry Access	Not Applicable	Not Applicable	Not Applicable	Not Applicable	Supported	Not Applicable	Not Applicable	Not Applicable
Android	Microsoft Edge	Not Tested	Not Tested	Not Tested	Not Tested	Not Applicable	Not Tested	Not Tested	Not Tested
Android	UponBI	Works	Works	Works	Works	Not Applicable	Not Tested	Not Tested	Not Tested
Android	Citrix Secure Web	Not Applicable	Not Applicable	Not Applicable	Not Applicable	Not Applicable	Not Applicable	Not Applicable	Not Tested

1. VMware AirWatch requires that the VMware Tunnel Server is implemented on a Linux appliance to support Per-App Tunnel connections. The older Mobile Access Gateway (MAG) product on Windows does not support websockets.
2. The MobileIron Sentry VPN Server requires minor tuning (TcpIdleTmoMs) to prevent aggressive termination of the websocket connections. The Web@Work browser must be configured to use use_WKWebView=true. The MobileIron Tunnel (app-proxy) requires a Custom Data key DirectLocalhost=true to enable Split Tunneling and prevent mis-routing of app-internal TCP traffic.
3. The PulseSecure VPN may be used together with several EMM products. Anecdotal field (GSK) feedback is that it works with browsers, but has not been validated by Qlik
4. Citrix Secure Web uses the Apple-deprecated UIWebView webkit and does not route websocket traffic correctly. Public sites will appear to work but routing traffic through the Netscaler to a private instance of Qlik Sense will fail. Consider using Safari with the Citrix VPN instead.

Unsupported EMM Suites

Product Management can be motivated by market demand and tangible commercial pressure to research and validate additional VPN technologies and EMM Suites. 

The choice of Enterprise Mobility Management (EMM) Suite is largely irrelevant to success. Most support the AppConfig standard that can be used to configure applications on the Mobile Device. 

What is important is the VPN technology that is managed by the EMM and may be included with it, which must support the Requirements listed above.

App Wrapping

Many Enterprise Mobility Management suites include an App Wrapping capability. This can be used to programmaticly attach EMM functionality such as a VPN Client or Multifactor Authentication mechanism to an existing iOS app. Customers/Partners may propose that Qlik supply them with the Unsigned IPA of Qlik Sense Mobile so that they can attempt to use this capability to create a customized version of Qlik Sense Mobile that might work in their environment.  The IPA can be supplied upon request to the Product Manager (via your Account Manager), BUT with the following conditions: 

1. App Wrapping is unproven with Qlik Sense Mobile. Qlik has no record of any attempt at AppWrapping being successful with Qlik Sense Mobile. The IPA contains a mixture of XCode and compiled C++, uses TCP to address components within the app, and relies on Split Tunneling for proper routing. It has proven too complex for automated augmentation using AppWrapping or even the features of the 3rd-party service AppDome.
2. The App Wrapping procedure and any iOS app that it produces is entirely unsupported by Qlik.