QlikView Extranet Deployment Issues

[#1]

Can someone help me with an issue we are experiencing.

QlikView Setup:  

• We have a Web Application that is calling a Qlik QVW using an iframe and the /QvAJAXZfc/opendoc.htm call
• The Web Application is a public website that our customers use
• The Qlik Web Servers are on our internal network and communication is allowed between the web app and Qlik only
• Qlik is not accessible directly from an external network.
• We use web tickets to authenticate users, have DMS Authorization setup on the QVS, Ntml Authentication setup on the QVWS, and IIS for the Web Server

Current Issue:

• We are getting an “Unable to resolve the server’s DNS address” when we access Qlik from our Production Environment from an external (public) network
• We are able to connect to the same Qlik Environment when logging in from an internal network of our company

The iframe is making a call to https://qlik.sitename.com/QvAJAXZfc/authenticate.aspx?type=html&try=/QvAJAXZfc/opendoc.htm?document=..., where qlik.sitename.com is the DNS address of the Qlik WebServer. Can someone tell me if we have something missing from our configuration? Does the DNS address need to be accessible from the external network in order for this to work? Thanks in advanced for your help.

[petter]

First of all can you access the QlikView AccessPoint from the Web Application server with a normal browser? If you can't there is no way that and IFRAME would work. Try to logon with Remote Desktop on the Web Application server and start a browser there. Try the https://qlik.sitename.com first and then https://www.xxx.yyy.zzz/qlikview secondly...

Are you able to ping from the outside to the QlikView Server?

You should try to use IP addresses instead as that leaves out the added "complexity" of yet another protocol and resolution of DNS setup between the external internet and internal DNS-setup which AD uses. So you narrow down the problem to getting it to work but only with IP-addresses.

[petter]

[#4]

We are able to see AccessPoint when we open https://qlik.sitename.com/.‌ We cannot ping from outside but that is by design. We are wanting (hoping) that we do not have to expose the QlikView Server directly to the outside only to the Web App server.

I wish this was an option but that it out of my hands. I talked to the operations group and they have it setup so that the Web Application is able to resolve the internal DNS but if you were to try to directly access the DNS from outside our internal network it will not work.

In order for the iframe and /QvAJAXZfc/opendoc.htm call to work would the user need to be able to access the DNS directly or should it be enough that the server that is hosting the website can access it. From looking at the call the iframe is making it makes me thing that the user would need direct access. https://qlik.sitename.com/QvAJAXZfc/authenticate.aspx?type=html&try=/QvAJAXZfc/opendoc.htm?document=...

[petter]

An intermediate server that has web pages that contain iframe(s) will not work as a passthrough. That would be gaping security hole. QlikView's webserver or the QlikView assigned IIS must reside on the "outside" of the firewall. But this computer has to have the necessary ports open to communicate with the QVS. They are not using HTTP to communicate with each other. They are using various ports that are documented fully in the QlikView Server Reference Manual. Furthermore there are techincal documents that describes how to setup an extranet-site.