QlikView login problem with NGINX reverse proxy

[manuele_silvest]

Hello everyone,

i have a problem with reverse proxy NGINX (cloud) with Qlikview 12.1 SR8 (on premise) and windows authentication.

Qlik is installed with Qlik Web Server (not IIS). 

When I use windows auth, the system shows the normal pop up box for authentication; but when I enter the credential, i have always ACCESS DENIED.

I Think the problem is with pass through NTLM credentials because with the configuration as FORM as is ok.

Someone can help me please?

These are some rules:

        proxy_redirect $scheme://$host/form/ $scheme://$http_host/form/;

        proxy_redirect $scheme://$host/ $scheme://$http_host/qlikview/;

        proxy_redirect $scheme://$host/ $scheme://$http_host/QvAJAXZfc/;

(        proxy_redirect $scheme://$host:4248/windows_authentication/ $scheme://$http_host/windows_authentication/;)

(        proxy_redirect $scheme://$host:4244/windows_authentication/ $scheme://$http_host/windows_authentication/;)

many thanks

Manuele

[Brett_Bleess]

The only thing I can offer here is the following Help link that may provide a bit more info for you.  I honestly cannot recall if I have heard of anyone doing reverse proxy setup with our web server as well, so it may be better to switch over to IIS/QlikView Settings service instead as well if you know IIS better.  Our QlikView Web Server is really designed for environments where it is a small environment where there is not much in the way of IT resources available, but it is based upon the IIS engine, just FYI. 

I do believe your theory is on the right track, but I am no guru here, so I am not sure if there is a means to overcome things or not.  The only thing of which I can think is the proxy is causing things in our backend to think the connection has changed and is invalidating the ticket we generated, but that is one thing to check, look in the QVS event log and see if there is a ticket being generated upon your Auth request.  Now that I think about it, you may need to look in the QVWS log in this case, as I think you will see things there too. 

Apologies I do not have anything better but hopefully this may help a little.  Try Fiddler trace as well, as sometimes that can provide some insights or maybe just the web browser dev tools network trace as well potentially may catch something you cannot see directly.

Regards,
Brett

[erikskogh]

Hi,

We're running QlikView 12 thru an Nginx Plus reverse proxy for external access and it's working. I took me a while but the trick is to add keepalive 16; inside your upstream { }

Here's my config:

server {
listen 80;
server_name qlikview.domain.com;
rewrite ^ https://qlikview.domain.com$request_uri? permanent;
}

server {
listen 443 ssl;
server_name qlikview.domain.com;
status_zone qlikview.domain.com;

access_log /var/log/nginx/access_qlikview_domain_com.log;
error_log /var/log/nginx/error_qlikview_domain_com.log error;
access_log syslog:server=opt-log2.domain.local:12301 graylog2_json;
error_log syslog:server=opt-log2.domain.local:12302;

include /etc/nginx/includes/ssl.conf;

location / {
proxy_pass http://qlikview.domain.com;
proxy_http_version 1.1;
proxy_set_header Connection "";
}
}

upstream qlikview.domain.com {
zone qlikview.domain.com 64k;
server xx.xx.xx.xx:80;
keepalive 16;
}

[manuele_silvest]

Thanks for sharing Erikskogh.

Is there any other specific configuration on QlikView to set in?

We have QlikView WebServer (not IIS) + Publisher with NTFS authentication.

 I will update you soon, thanks