Integrating third pary SSO/MFA solution

[brianlucci]

I am planning to upgrade our QlikView 12.0 environment to the latest version (Apriel 2019 I believe is the latest).  The current environment is running on Windows 2008 R2 as well and I would like to setup a Windows 2016 or 2019 server to run the upgraded version on.  I found the documents how to do the upgrade, but what I am wanting to do is integrate our SSO/MFA solution with the new version.  We use a product called Portal Guard that does the SAML based authentication.  I found numerous documents on the QlikView support site that talks about SSO with third party products, but I counldn't get a clear understanding from them on what was needed to be modified within QlikView to redirect to our SSO page.  Some specific questions I had were the following:

1.  We are currently using the QlikView Web Server in version 12.0.  Does using SSO/MFA integration require an IIS web server or can we continue using the QlikView Web Server?

2. What config do we have to change to redirect to the SSO page and where is this located?

3. What are the variable mappings we need to setup in our SSO configuration to pass the id variable values back and forth?

At a minimum I would like to get the new version installed so I can play around with it but want to know what web server type we should use so we can eventually configure the SSO/MFA integration successfully.

Thank you

[Brett_Bleess]

Brian, you are going to want to use the QlikView Settings service/IIS option in your case, as I am not sure you would be able to get things to work using our web server, it is pretty limited in its configuration capability.  Our web server is the IIS engine, but we limit the configuration capability, so I would definitely guide you to go the IIS route in your case, as I am pretty sure you are likely going to need it in order to get the SSO working properly from what I have seen at other customer sites.  Generally, most of these solutions do have things that have to be installed in IIS etc. and configured, so hopefully you will be able to figure things out.  

The key thing is likely the Authentication whitepaper PDF that should have been one of the articles you ran across, but here is a link to it as well, just so you know which article I would likely focus upon to try to help figure things out.  You are definitely going to want to use either the Header option on our side or the GetWebTicket method, and the QVServer will need to run in DMS security mode as well in this case, just FYI.

Customized Authentication in QlikView...

Hopefully this helps.  You may want to consider reaching out to your account manager if you get stuck on things, they can see if we can arrange a short engagement with our consultants or a partner that has done similar integrations to assist you in getting things working, but I suspect if you are pretty good at tracing etc., you may be able to get things sorted on your own.

Regards,
Brett

[brianlucci]

Hi Brett,



Thanks so much for getting me pointed in the right direction!