where a complete, documented and downloadable solution is available.
In summary, you will embed in SalesForce an intermediate URL that receives Session parameters from SalesForce then performs WebTicket before redirecting the User to a QlikView URL. The intermediate URL will be physically hosted within your own environment (not on SalesForce) and THAT address should be trusted in the IP WhiteList.