Qlik Community

As we all know Qlik Analytical Platform is quite new in market. People are still in confusion as what QAP is, how it is different than Qlik Sense Enterprise. How to configure QAP Server, Manage QAP and especially what exactly the output of

...

Hi All,

As we all know Qlik Analytical Platform is quite new in market. People are still in confusion as what QAP is, how it is different than Qlik Sense Enterprise. How to configure QAP Server, Manage QAP and especially what exactly the output of QAP. There are lots of tickets which give you chunk of information like difference between QAP and Qlik Sense Enterprise, how to reload on QAP server when there is no HUB under QAP but there is nowhere how to configure a QAP solution from scratch to end with details.

This document guide you to know what QAP is , how it is different than QSE, setup QAP Server, create and publish Mashup(Embed Analytics ) a, manage QAP Objects and reload application on QAP when there is no HUB at all.

Question: Why Qlik Sense client needs QAP ?

Answer:

QAP is for external users simply which doesn't need self service or QSE capabilities.
DMZ network where external users are not allowed to access application from internal network.
Client doesn't want to buy hundreds of Qlik Sense tokens for such users which don't need deep analysis.
No certain details of Qlik Sense end users like users count, user details(anonymous).
Embed Qlik Sense objects in client’s web portal like any news paper, public portal etc.

QAP setup needs knowledge of Qlik Sense Enterprise (server configuration with security rules) and web developer skills (css and java script and basic HTML) who will help you to embed Qlik Object to web portal.

I have attached one QAP product presentation, you may start with it then below tutorial video so you have enough functional knowledge of product.

Important video tutorial of QAP:

Let’s start from beginning:

Difference b/w Qlik Sense Enterprise and Qlik Analytical Platform:

In principle QAP and QSE is same but in general QAP is subset of QSE means QSE without HUB(No Self Service). QAP is a solution of embed analytics. If no self service is there in QAP it means no "create things" but still developers can create visuals by APIs.

Https://HostName/hub you can view the application but when you open it, it will give you an error you don't have access pass, it means you can't view any apps object on hub.

QAP enables you to display sheet or charts into your website.

Commercial difference, QAP has core based license model unlike QSE which has token based license model (It means no user and login passes, which means you just need to grant the access to users or authorized users to the content which is embedded in web portal )

Recently Qlik introduced core bases license for self service too.

QAP is intended for using our APIs (Extensions, Mashups etc.) to deploy custom solutions.

The Qlik Sense client is disabled in QAP (when you will login to hub you would view the streams and apps but when you will click on any app, it will give you error of access passes).

It has same installation package as QES but applying a QAP license key will disable hub it means you can view the hub, streams list, and application icons but apps objects like sheet, charts, measures and dimensions will not open on HUB. It will give you an error, you hve no access passes.

QAP license policy: when a client buys a QAP token, it comes with minimum 4 cores, it means no matter how many cores or virtual processors are available on deployment server, it will only consume or utilize 4 core among all available cores. So, let’s say client's server has 8 cores or 16 logical processors on Qlik Sense Enterprise server and your application size is 1 GB and you are planning to use same application on QAP, So when you import this application to QAP, It will not work as it works on QSE sever cause QAP(as per the license capacity) will consume only 4 cores out 8 cores and your 1 GB application need 8 cores to perform or load objects like QSE.

Note: Do not be confused, what will happen when you will activate the Qlik Server with QAP license, you will get everything same i.e. QMC as Qlik Sense Enterprise but there will be no Tokens means you can't create any user or login pass which we use to authorize users to access the Qlik Sense content.

To implement QAP server, configured it security with custom properties so you would manage security of data for users with

https://community.qlik.com/docs/DOC-18066

These 9 points will create a stream, import the application and publish the application to the newly created stream and grant access to application and app objects.

Try to use Dev-Hub to view the object i.e single configurator.

Now, we will add one more new security rule which will grant all the users to access the APIs like extensions, mashups, Widget, Single configurator.

***You may create one new custom property QAPExtension with resource type Extension and User and the create a new security rule with Extension Template and write a security rule as:

((User.@QAPExtension=resource.@QAPExtension))

Then go to the extension by Click one start => Extensions => select your extension(Mashup) => go to custom properties and click on the Space bar and select the value you have given while creating Custom properties do the same exercise for users too .

Now, we don’t need to create any custom property because QAP is for all users (no limit) above activity started with *** is when you created a mashup and then you need to provide access of some particular Extension(Mashup) to any specific users.

So, for QAP, write a simple security rule as with template Extension:

((user.name="*" or resource.name="*"))

Which means all user will access the all the APIs (extensions, mashups, Widget, Single configurator).

Often, People ask what if my client hasn't any web portal so in that case above Mashup solution will work, Mashup is kind of website(.html file) or web solution.

This is best with Qlik comes Sense as we can create a HTML page with our Qlik Objects so easily(Basic HTML and JS and CSS knowledge requires).

Now point comes, if all user will come how to secure the data, here comes the real QAP solution,

Generally what QAP says, create an application on Qlik Enterprise or Desktop, import on the QAP server and publish its Objects to client website (Mashup is a HTML page but it’s not a web portal).

So above, you have imported an application, created stream, published application, granted access to all users. What is left now, go to single configurator, select one object, there will be two links come on top side, Iframe and URL, Copy anyone and go to the website page where you need to show these objects and paste it(Please take the help of web developer because every object needs a proper space and alignment).

If any user who is not authorized to view Qlik objects but has rights to login web portal where Qlik Sense objects embedded then it will show an error, so you may ask your web designer to handle this case and put any image instead of INVALID OBJECT message from Qlik Sense.

Now when any user will come it will see an error, access denied or ask for credentials , so You may configure the single sign on here ,Please refer the very useful document for single sign on :

https://community.qlik.com/community/qlik-sense/support/blog/2016/05/11/qlik-sense-ticket-based-authentication-step-by-step-configuration-example

Last Point, how to manage the QAP server application. I mean, reload and all. So, You can’t open any application on QAP HUB and there will be no script editor so how to reload if you have imported the application from Qlik sense enterprise:

If you have imported the apps from another Qlik Sense Server the required data connections are unfortunately not imported together with the qvf-file. That is probably why the tasks fail since the data connections are missing. Check in QMC > Data Connections if they are there and if they are properly set up.

Please refer this article to reload data in QAP: https://qliksupport.force.com/articles/000025412

” When you import an app developed on Qlik Sense Desktop, existing data connections are imported to the QMC. When you export an app from a server, existing data connections are not exported with the app.”

Since the QAP is a Qlik Sense-server without the "hub" and aimed for integration purposes only you have to find a way to import the data connections into the QAP QMC for reloads to work. One way could be to create an empty app in Qlik Sense Desktop with the required data connections and then import this qvf into the QAP. Then you can manage and set up the imported data connections properly in the QAP QMC.

Reach to me for further assistance, Please drop an email to kumar.rohit1609@gmail.com

Add me on Linked In : https://in.linkedin.com/pub/rohit-kumar/2b/a15/67b

Add yourself on Qlik intellectuals page on Facebook at https://www.facebook.com/QlikIntellectuals

Please like this page or add as bookmark and add your ratings so my I will know how effective my solution is for Qlik Users.

You may add your queries below so I would come up with solution. I will try to keep update this document with more powerful inputs. Your queries and inputs will help me to improve the quality of this solution. The aim is to make a perfect document which will guide you to a perfect solution.

Patric_Nordstrom · 2025-05-16

At Qlik Connect 2025 I hosted a session called "Top 10 Visualization tips". Here's the app I used with all tips including test data.

Tip titles, more details in app:

Open ended buckets
Cyclic reset
"Hidden" columns
Labels in different sizes
Oth

...

RadovanOresky · 2020-01-22

Monitoring current performance and availability of Qlik Sense site is not out-of-the-box feature, but can be easily achieved with native REST connector and requesting engine\healthcheck JSON API.

There are other tools and approaches, but since I alrea

...

Monitoring current performance and availability of Qlik Sense site is not out-of-the-box feature, but can be easily achieved with native REST connector and requesting engine\healthcheck JSON API.

There are other tools and approaches, but since I already have the best BI tool available 😉, I found it reasonable to use it. All that is necessary is just:

download and import the attached app
create REST Data Connections and adjust the settings in the script
schedule app reload

This Qlik Sense app:

loads engine\healthcheck JSON data from multiple nodes
parses and consolidates it to two tables
stores them to QVDs with all previous snapshots
visualizes key metrics of engine utilization and availability in time

It's recommended to deploy and schedule this app on DEV or TEST site, pointing to all production nodes. Otherwise, there will be no data loaded in case the production engine (or the whole server) crashes.
(just FYI - DEV and TEST sites are included in the professional license subscription)

It's also recommended to read the official help site info about the engine API before you deploy this app.

After importing the app to a suitable site, follow these steps:

1. Decide on target folder for result QVD files, where parsed snapshot of JSON data will be stored. Create a folder Data Connection (if it doesn’t already exist) and set its Lib name to vQVDpath variable in Settings script section.

2. Create a REST Data Connection to each node:

URL: https://<server domain>/engine/healthcheck OR https://<node IP address>:4747/engine/healthcheck

Authentication Schema: Windows NTLM
User name & password: type root admin or service user credentials
check "Skip server certificate validation" if there is no valid certificate on target node

Query headers:
User-Agent: Windows
Cache-Control: no-cache

3. Adjust the INLINE table in the Settings section of the script according to your site

node - name of the node that will be shown for app’s user
restConnection - name of the REST connection that points to node’s engine/healthcheck
RAM - amount of node's memory in GB
CPU - number of node's logical processors

4. Schedule a reload task. The recommended app reload frequency is 5 minutes or less (tested reload duration on the 4-node site is 12 seconds). The script will return "N/A" in [isSaturated] field when the engine is not responding.

The current roadmap includes - script for email notifications, possibility to load only N days back, mapping app name to IDs, node comparisons.

PLEASE! If you make adjustments or additions to the script or front-end visualizations, please share them back on the Qlik Community.

Happy Qliking 🙂
-RADO-

hic · 2013-03-18

Have you ever wanted to create a Scatter chart or Bubble chart in QlikView, only to find that it was more complicated than you thought? Then you should look at this document that contains some example files for making this type of chart and instructi

...

robert_mika · 2015-02-22

Prologue...

Firstly I would like to say that probably it would be easier to call this function Horizontal Dimensionality (or HDim or even SecDim)

This could clear some clouds - when you first see this function you may feel that this another level for d

...

robert_mika · 2015-08-12

Have you ever wondered how the examples from the Qlikview help may look like?

Please see below and enjoy responsibly...

Valueloop() & VaueList()

Both of those functions belong to Synthetic Dimension Functions.

Synthetic Dimension is a type of Calcula

...

Patric_Nordstrom · 2020-12-21

Ok, here's another batch of tips when building visualizations in Qlik Sense. It's a mix of recipes for new charts and tips for app development. Content as follows, full descriptions and demos in the app below.

Charts

Radial bar chart / Activity g

...

JaMajka1 · 2020-01-13

I like mathematics and see the potential it is not only in robotics or “almost sci-fi” technologies but everywhere where data is generated and should be understood.

I like Qlik, its possibilities and simplicity for end-users at the same time.

However,

...

jagan · 2014-04-15

Hi,

Please find attached Qlikview document for implementing chart level access by user. You can open the Qlikview file by using users A, B, C and D. There is no Password for this file.

When you login as user A you can access both charts (CH01 a

...

Carlos_Reyes · 2013-10-19

Aside from filtering data records with Section Access, I'm usually requested to filter the objects and sheets to which users have access. To be honest, I don't like to filter individual objects since this implies a lot of mainteinance and a more com

...

Aside from filtering data records with Section Access, I'm usually requested to filter the objects and sheets to which users have access. To be honest, I don't like to filter individual objects since this implies a lot of mainteinance and a more complex Section Access table. So I usually describe the scenario to the IT people and Key users and they always ( so far ) decide to go for the Sheets-Security option. Which in my opinion is the best alternative because it's more common to hide a complete block of information/analysis from a user than just a single KPI.

I've seen some examples like this before in the Community, however everything I've found its exemplified based on the USERID field. So, when I tried to use those examples I ran into some common errors when dealing with Section Access, and now that I've solved them I want to share a small example about how to go when using NTNAME.

Also, I want to note that there are some easier/faster alternatives to this approach. For instance you may use the MATCH() method described in this thread: Secured sheets

However if you're already using Section Access to filter data, you have too many users and/or sheets to use the MATCH() method, or if you just need to handle those privileges outside of the .qvw ( e.g. a user will maintain an excel file), you can use/reuse Section Access to accomplish this requirement.

In my example I use INLINE loads in order to allow other people to reload the app, however you could load all tables, including the SECTION ACCESS table, from xls or qvd files.

So, in order to test this example you have to do the following:

Download the enclosed file
In the script, go to the Section Access tab and uncomment the disabled code.
In the same tab, change the NTNAME and USER field values in order to reflect your local/domain users.
Go to Document Properties/ Opening and enable Initial Data Reduction Based on Section Access. Do not enable "Strict Exclusion"
Save and reload the app.
- Note. If you have and use Publisher you'll need to add the account that runs QlikView services as an admin profile in the Section Access table before you reload and distribute the app.
If you only use the Desktop, save and exit any QlikView instance and reopen the application. If you want to check all profiles you'll need to sign out of Windows and sign in as the profile's user. You'll probably have to copy the file into a usb in order to open it in all the Windows accounts.
Depending on the user you used to sign in you should get the following results:
- If you signed in as the admin user (first record in Section Access table), you should be able to see both sheets (A and B) and all Countries and Cities.
- If you signed in as the first user (second record in Section Access table), you should only see sheet A but all Countries and Cities.
- If you signed in as the last user (third record in Section Access table), you should only see sheet B and cities from MEXICO and USA.

Go to the following link to get the example file:

Sheets Security with Section Access File

I hope this example is useful and don't hesitate to ask if you have any doubt regarding it.

mbj · 2016-10-27

Table of Contents

Security integration: Provide Single Sign On and share access rights
Introduction
- Authentication
- Authorization using the security rules
Detailed securi

...

Table of Contents

Security integration: Provide Single Sign On and share access rights
Introduction
- Authentication
- Authorization using the security rules
Detailed security rules
Appendix A: Streams
Appendix B: Security flow when opening an app
Appendix C: Sense ticketing API explained
Appendix 😧 Security approach summary
Appendix E: More information and tools about security?
Appendix F: Security rule examples

Introduction

In OEM software integration cases, users and their authorizations are stored usually in a SQL table and the OEM website already does the authentication step. So the key thing we have to explain you in this article is how do we transfer the user and his rights to Qlik Sense? The short answer is: We usually do this by using a ticket (token based) mechanism. This ticket can be seen as a passport for the user. It contains his userId, and the groups/roles which define his authorizations.

Make sure you check the introduction and extended security videos first.

Authentication

Before you can use the Qlik Sense system, in most cases you want to know who the user is, we call this authentication. The next step is that based on this userId you want to assign the user access rights, we call this authorization. Both developers and users communicate with Sense via the Proxy (see this as a webserver which performs the authentication step: who are you?). For each type of authentication we can create a virtual proxy. So normally we would create a virtual proxy for each authentication mechansim your company needs:

Internal users using Active Directory
External users using ticketing
External users using SAML

Authorization using the security rules

After the authentication (who are you?) you need to think how you want to integrate the authorization (what can you do and see?). The keys you want to protect in Sense are called resources. Example resources are

In the client side, called the hub context:
- Stream
- App
- Object.type inside an app
  - Sheets
In the admin side, called the management console (QMC) context
- Reload tasks
- Security configuration
- Apps and objects
- Streams

Users

There is no mandatory structure you have to follow in Sense. We have designed a very flexible approach in which each "thing" in Sense is a resource. And if you want to "use" it you need to have a "key" that allows you to access that resource. In Sense we protect the resources above with security rules, and it has the following logic:

In other words:

If you want to see a resource (or edit/publish…)
You need at least 1 rule that evaluates to true
Note: that this rule must provide access (resource filter) to all resources you need. If you want to see a chart, you need access to
- The stream
- The app

The app.object for at least one type

Example Admin 1

If your Active Directory group = Admin
Then you are allowed to access all resources in the context of the QMC

Example End user 1

If your Active Directory group not equal to Admin
Then you are allowed to access all resources in the context of the Hub

In most OEM cases we give each customer its own stream, and therefore we create a rule like this to split the customers in the system

Allow a user to view (Action),
all dashboards inside a stream (Resource)
Provided that the group (e.g. a customer name) of the user matches the name of the stream

Lets illustrate this with the example of a city (a Sense server), it consists of

streets (streams) which are used to
group houses (apps), and a
house consists of rooms (app.objects).

Most people can only enter 1 house and all rooms. But in order to arrive at your room, you will have to drive though your street, open the house and enter your room. And that is exactly the same way with an OEM security setup in Sense.

SaaS security setup

Most times you have a SaaS solution with a lot of customers in 1 system. You want to divide this. So, we start with giving each customer its own stream, and once you have access to the stream you are allowed to view all apps. Of course we can limit the access to apps and even sheets, the script and database connections. This is possible because everything is a resource is Sense. And before a user can access a resource he needs at least one security rule that evaluates to true for the action he would like to do (read, update, publish).

Minimum requirements of the security rule

Back to our example of the street and the houses:

You always need access to a stream before you can open the app, or view the resources inside an app:

Stream: The highest level is the stream (e.g. a street), once you are in the street you can see
App: The apps (the houses), once you enter a house you can see
App.object: The app.objects (the rooms) like sheets, stories, script, database connections etc.

Import to remember: If you want to see a chart, you always need to create one or more security rules that together provide access to all the above resources. (stream, app, app.object)

Each resources knows always who its parent is. So you can make a security rule that says

If the user tries to access a Stream:
- The name of the resource (in this case a stream) = (must equal) the name of the group of the user
Then: you are allowed to see me

Now the user is authorized to see the stream. The next step is to grant him access to the app and app.object with this rule:

If the user tries to access an app or the contents of an app (e.g. sheet)
- If you have access to my parent (has privilege)
Then: you are allowed to see me

Detailed security rules

Sense security is based on Attribute Based Access Control ABAC. Each time a user requests access to a resource, Qlik Sense evaluates the request against the security rules in the Qlik Sense system. If at least one rule evaluates to True then Qlik Sense will provide the user with access according to the conditions and actions described in the security rule. If no rules evaluate to True then the user will be denied access. The fact that Qlik Sense security rules are property-based makes Qlik Sense very scalable as you can build rules based on properties that apply to groups of users. In most BI systems you need to create a role for each organizational value (Spain, France etc.), this is not needed with Sense. We just use a variable to variable comparison: e.g. If your Active directory group (or group provided by ticket/SAML) matches some property of the stream/dashboard you are allowed access. For more information about Security rules see this video or the Qlik Sense help

If you don't have a key you won't get in, same like your house. If you have a key you can enter your house, and all rooms inside it. (Access to stream, Yes? Ok, than you might see all the dashboards)

So for Sense, if you have access to a stream maybe you want to show the user all dashboards inside the stream. In this way you keep the security concept very simple and effective. As a starting point I would recommend to give each department (HR, Finance) or customer (Customer A, Customer B) its own stream.

So we can give users access to a dashboard, and define whether he can use/edit/create Sheets, Stories, bookmarks etc. For example, if the user does not have access, that is a security rule that evaluates to true, he won't see the edit or bookmark button in Sense.

Authorization summary

Authorization check points

Authorization steps:

Example resources

1: Security rules in the QMC: Stream, apps and other resource access control

Which streams are you allowed to see?
Which dashboards are you allowed to see?
Which sheets or buttons (Edit script, edit dashboard, story telling) are you allow to see?

Apps, sheets, stories, script, database connections

Nodes

Content libraries

Proxies

Repositories

Streams

Users

Data connections

Engines

Extensions

Virtual proxies

Schedulers

Reload tasks

2: Section access in the script of a QVF to provide row level security

Section access

This section contains more info about the "second step" of the picture above: Which data and fields are users allowed to see?

Section access to filter data:

We load your security table as a regular table, we put this in a special section in the script called "section Access". This behaves exactly the same as the normal script. Except that it makes a "mandatory selection" or filter if the user opens the dashboard. Note that you can load users or groups in this section access column "UserId". If you send in the ticket attribute with the name “group” it will be used to restrict on in section access. So based on the group provided in the ticket you will see only your data.

In the example on the left: if user John logs in, Qlik Sense makes a "fixed selection" which is basically an inner join between the security table and the datamodel. If John logs in, he will only see the data where department is Finance.

Security using hierarchies

Security is never a simple model, most of the time companies are organized using hierarchies. Qlik Sense allows you do authorize on this.

See this for more info on authorization using a hierarchy.

In this way you can authorize on a node, and the user will see all the children of the node. Note that this demonstrates the power of our script, the authorization on hierarchies is for example not possible with "pure visualizaton tools" which rely on 1 view to be supplied as input for the dashbard.

Example: OEM security example use case for a fictive OEM partner

Functional design of the security principles

Each customer can only see its own data. Each customer can have 1 or more users. These users can be a member of 1 or more groups/roles which determine what they can see or do in the system. E.g. a manager can see the "whole world" and a regional manager only his "own region".
- For example we have
  - 2 customers: Sunny and Cloudy Petrol. Each customer can have the roles
    - Manager and

Employee.

The security concept should be as simple as possible. In the first phase we will authorize on streams and therefore we will give each customer its own stream. (A stream is the key grouping structure of dashboards)

Technical design of Qlik Sense security:

We have to configure the following layers

Give each customer its own stream.
Create a security rule to authorize on this stream.
Use section access to enforce row level security of the data.

1: A stream per customer

2: Security Rule

In the management console of Qlik we define 1 security rule to enable "resource access control".

For ticketing use: user.environment.group=resource.name (in this case the stream is the resource)

For AD use: user.group = resource.name

3:Section access

In the script we mark a special section as security. In the section we can limit per dashboard what a user/role can see (data filter/reduction). We do this based on the attribute: 'group' you provided in the ticket. In this way you don't need to sync user-group relationships to Sense.

Integrated security overview

The picture below outlines the complete flow from user single sign on with ticketing, to row level security via section access.

security flow complete.png

Key take aways:

Authentication

To create a single sign on model you only need to

Create a virtual proxy in Qlik Sense specific for your app
- Allow only authenticated users
- Forward the user to your authentication module if not authenticated.
Your auth. Module then authenticates the user and requests a ticket for this user, this ticket includes his group membership.
Forward the user to the orginal URL he tried to access, with the ticket number appended. (http://server/proxy/hub?ticket=12345)
In the Sense QMC, you create 1 security rule to map the name of the stream (grouping of dashboards) to a group you provide in the ticket

Authorization

Row level security

If you need more fine grained security this is possible, because everything in Sense is a resource and you can assign attributes/tags to each resource where you can authorize on.
E.g. authorize on individual app, sheets or buttons
Use the group you provide in the ticket also to reduce data in the dashboard (row level security)

So this is what you DON'T need to do anymore

You don't need to keep your source system in sync with Qlik Sense. Because the only link between your system and Sense is the group (or other attributes) you assign dynamically in the ticket request code you write. You only need to create the template apps. The rest will be generated by your system by making use of the API's.

More security documentation can be found here

Appendix A: Streams

See a demo of streams here

The content in the hub is organized in streams. A stream is a collection of apps that a group of users has specific access to. The users of the stream can have different access rights. Some users might only be able to read the content in the stream, while others might have the rights to publish their content to the stream.

Appendix B: Security flow when opening an app

Introduction

Users interact with Qlik Sense using authenticated communication through one or more proxies. Information is transferred using cookies. The cookies are necessary regardless of authentication type used. When using a web browser, the web browser sends a ticket to the proxy. The proxy then returns a cookie to the browser and this cookie is included in the communication with the Qlik engine. When using a custom client, the client must set the cookie and provide it to the proxy.

Authentication

Authentication is the procedure of verifying the identity and credentials of users wishing to access Qlik Sense. It can be done in various ways:

Windows authentication using cookies
SAML
HTTP header authentication using cookies and headers. Header authentication should only be used when custom authentication systems are used.
You can also extend with custom authentication modules like the ticketing method we always use in software integration scenarios.

Security example: The figure below shows the flow in the Qlik Sense security system when a user logs in and opens a app.

Authentication: The authentication module in the Qlik Sense Proxy Service (QPS) handles the authentication. The credentials provided by the user are verified against information from the identity provider (for example, a directory service such as Microsoft Active Directory).
Session creation: When the user credentials have been successfully verified by the authentication module, a session is created for the user by the session module in the QPS.
Access control system: When the user tries to open an app, the Qlik Sense Engine Service (QES) requests the Qlik Sense Repository Service (QRS) to check if the user is authorized to perform the action. The QRS then checks the repository database, where, among other things, all users and access rights are stored.
The users are imported into the repository database from one or more User Directories (UDs) (for example,Microsoft Active Directory) using Qlik Sense User Directory Connectors (UDCs). The import is triggered by the Qlik Sense Scheduler Service (QSS) and the intervals in-between imports can be scheduled.
Dynamic data reduction: When the user has been successfully authorized by the QRS, the app is opened. Before the data is displayed to the user, the QES performs a dynamic data reduction, where the data that the user is allowed to see is prepared.

See also:

Planning Qlik Sense Deployments: Authorization

Planning Qlik Sense Deployments: Access control

Planning Qlik Sense Deployments: Data reduction

Managing a Qlik Sense site: Virtual proxies

Qlik Sense Proxy Service APIs

Introduction to QlikAuth

You can create the ticketing implementation yourself via the QPS ticket API, or use the QlikAuth module. QlikAuth is a community tool/wrapper for .NET, JAVA, Javascript around the Qlik Sense Ticket API

Appendix 😧 Security approach summary

Appendix E: More information and tools about security?

What

Where

Security in Sense

See blogs by Fredrik Lautrup

Security rule examples

Section Access

Tips and tricks for section acess

Authorization using a Hierarchy

Complex authorizations

Data reduction using multiple fields

Access Control test module

Using ticketing. This is an authentication module that can be used for testing access control in Qlik Sense. This is also an example of how an authentication module could look in NodeJS

Session API test module

This is a example implementation in Nodejs of how the Session API in the Qlik Sense Proxy can be used

Load Balancing test module

Proof of concept implementation of the Load Balancing module API that implements a random load balancing algorithm

Setup header authentication

Header authentication is nice if you want to perform some tests with tools like fiddler, or if you have an architecture which uses an authenticating reverse proxy. Don't use this in other cases because a malicious user can misuse this technique.

Stefan Walther, explains how to setup header authentication and shows you how you can test this using Postman.
Qlik Sense 1.1: Set Up Header Auth Virtual Proxy, article by Jeffrey Goldberg on Qlik Community

Authentication with HTTP headers, article on Qlik Sense for Developers (2.1.1)

Using Xrfkey headers, security measure, explains that if you use the REST API (which is an URL with JSON in the body to send messages to Sense), you must put a string XYZ of 16 chars both in the url as well as in the header attributes.

For testing purposes it is easy to setup a virtual proxy with header authentication. Make sure you use the path for the REST calls which include this proxy. (http://srv/YOURPROXY/qrs). Don't forgot the http:// and ensure you allow http in the virtual proxy.

Example config using Postman

If you send this:

Request	Response from Server

Authentication using certificates

If you have server side software you can use certificates to authenticate against Qlik Sense. In this way your software tool can talk as admin to Qlik Sense.

Stefan Walther's explains it here on github

Authenticating with the server certificate in Qlik Sense Help for Developer 2.1.1

Authentication using ticketing

In your software tool you can also supply a ticket you got from the Qlik Sense proxy API.

You can use the Qlikauth module from Rikard Braathen for most programming languages

See Mindspanks code on Github here

Export and import the security rules

Use this tool from Fredrik Lautrup

Appendix F: Security rule examples

You can make the security in Sense as complex or simple as you want, I defined a couple of scenario from simple to complex.

Scenario	Authorization business rule description
1	Only authorize on streams
2	Authorize on the combination of streams and apps
3	Authorize on the combination of streams, apps and resources inside an app (sheets, stories, script, master items)
4	Authorize on rows and columns
20	An External tool should have full access, except to delete the "Template" and "Everyone" streams and apps.

Scenario 1a: Authorization business rules Stream authorization

For our fictive company we defined the following rules

We have defined groups in the source system. This can be AD groups (user.group) or the groups you supply in the ticket (user.environment.group).
Each customer can only see its own stream
- Within a stream he can see all apps
Within an app he can only see the sheets and stories but not the backend

Scenario 1b: QMC Admin

Same as 1a
But now each customer can also have an admin that should have access to the QMC

Scenario 2: Authorization business rules: App authorization

Each customer can only see its own stream
- Within a stream he can see specific apps
Within an app he can only see the sheets and stories but not the backend

Scenario 3: Authorization business rules: Sheet authorization

Each customer can only see its own stream
- Within a stream he can see specific apps
Within an app he can only see the sheets and stories but not the backend

Scenario 4: Apply row/column level filtering

Each user can only see the data in the app where he is authorized for
For example, an employee can only see the orders (and everything associated) he created.

Security rule code for each scenario

Implementation of scenario 1a using the QMC - Security rules

Before we start, remember that If you want to see something, you need one or more security rules that give you access to

The stream
The app
The app.object

So in the examples below we create 3 rules (to make it manageble we splitted the rules per resource type, you can also create 1 big rule)

A rule for the stream
A rule for the app
A rule for the app.object

Modify standard rule set

Also we have to look at the standard security rule set in Qlik Sense. Here we have to disable some rules to prevent our your have too much authorizations. You can always find the rules that are active for your stream/app by going to the audit. Double click a cell, and you can see why John, has the rights to create app.objects (sheets, or basiscally all the "things" inside an app)

The rules below have to be disabled. To offer too much access to our users for now.

security rules disabled.png

Access to resource	Description	Security rule condition
Stream	Example security rule to give each user access to its stream	For use with Ticketing user.environment.group = resource.name For use with Microsoft Active Directory user.group = resource.name
App	Example security rule to give each user access to all underlying apps (for a consumer/display only user) if it already has access to the stream.	(resource.resourcetype = "App" and resource.stream.HasPrivilege("read"))
App Object	Summary Example security rule to give each user access to all underlying objects, but not the script and the data model viewer if it already has access to the app. Detailed If you a trying to "touch" a resource that is inside an app (app.object means sheets, stories, script) You are allow to see these all items inside an app as long as they are Published Not the script and the loadmodel, And you have access to the stream where the app is in.	((resource.resourcetype = "App.Object" and resource.published ="true" and resource.objectType != "app_appscript" and resource.objectType != "loadmodel") and resource.app.stream.HasPrivilege("read"))
	If you want to go one step further you can also authorize on sheets: Manager can see all sheets Employees can not see the "finance dashboard" and the "HR dashboard"	The security rule for employee: (resource.resourcetype = "App" and resource.stream.HasPrivilege("read")) or ((resource.resourcetype = "App.Object" and resource.published ="true" and (resource.objectType= "sheet") and (resource.name!="Finance Dashboard" and resource.name!="HR Dashboard") ) and resource.app.stream.HasPrivilege("read"))
Script: Section access	Row level security: In section access you can use the group of the ticket or AD to ensure row level security. In this way you can make sure that someone who is member of "group: Germany", can only see results in the dashboard where the data belongs to Germany.	Use the script below to authorize on groups (supplied in the ticket or via AD etc.) and on individual users Note: normally you just load this table from your SaaS platform. For demo purposes I just do an inline load.

Template Rule

(resource.resourcetype = "App" and resource.stream.HasPrivilege("read")) or ((resource.resourcetype = "App.Object" and resource.published ="true" and resource.app.stream.HasPrivilege("read"))

Implementation of scenario 1b: QMC admin per customer

Access to resource

Description

Security rule condition

Apps and Stream

An admin of a specific customer is allowed to see their own stream and apps in the QMC

Filter: QmcSection_Stream, QmcSection_App*, Stream*, App*

For use with Ticketing

user.environment.group="admin"

and

resource.stream.HasPrivilege("read")

For use with Microsoft Active Directory

user.group="admin"

and

resource.stream.HasPrivilege("read")

If you then create a user in your source system, and give him the admin group. He is able to see the QMC, only for his stuff.

And he can see this:

QMC Admin screenshot.png

Only his stream and only his apps which are published in his own stream

Read access but not a specific stream and its apps

Read access but not a specific stream and its apps.png

View everything in the QMC except apps and streams

View everything in the QMC except apps and streams.png

Scenario 30: Audit display all

Audit display all.png

Security rule summary

See Qlik help for an overview of the options in the security rules. In my multi tenant SaaS demo platform I used the rules below.

Rule name	Condition	Resource filter	Actions	Description
Z_OEM_API_TOOLS_APP	((resource.stream.name!="Templates" and resource.stream.name!="Everyone" and user.roles="QRSMeteorAdmin" and resource.IsOwned() and resource.owner = user))	App_,App.Object_	All	Root all for apps, except the everyone and template stream apps
Z_OEM_API_TOOLS_QMC	((user.roles="QRSMeteorAdmin" and resource.resourcetype!="App" and resource.resourcetype!="Stream"))	*	All	Everything in the QMC except the Streams and APPS
Z_OEM_APP_ACCESS	resource.stream.HasPrivilege("read") or (resource.resourcetype = "App.Object" and resource.published ="true" and resource.app.HasPrivilege("read"))	App_,App.Object_	Read	see all apps if you have access to the stream
Z_OEM_STREAM_ACCESS	((resource.name=user.environment.group or (resource.name="Everyone") ))	Stream_*	Read	end user: if you see the stream you are allowed to see all apps for your customer
Z_OEM_CONTRIBUTOR	user.environment.group="Contributor" and resource.published ="false" and resource.app.HasPrivilege("read")	App.Object_*	Create, update	A user with group contributor is allowed to create sheets in exiting apps, but no app creation
Z_OEM_DEVELOPER	user.environment.group = "Developer" and ((resource.owner = user and resource.stream.Empty()) or (resource.app.HasPrivilege("read") and resource.published ="false" ))	App*	All	A user with group developer is allowed to create apps, sheets and load data.
Z_QMC_ADMINS_CUSTOMER	((user.environment.group="Admin"))	QmcSection_Stream, QmcSection_App*	Read	QMC Menu only. Only give access to stream if the name of the stream match the AD group. Note, we disabled the default Stream Rule
Z_QMC_ADMINS_CUSTOMER2	user.environment.group = "Admin" and ((resource.resourcetype = "App" and resource.HasPrivilege("read")) or (resource.resourcetype = "App.Object" and resource.app.HasPrivilege("read")) )	App_*	Edit, publish	Administrators are only allowed to maintain the apps and app.object in the QMC
Z_Root_ALL	((user.roles="RootAdmin"))	*	all	Root: Hub and QMC full access

vinieme12 · 2016-07-07

Preset Calendar now with Sort Order

Added two Sorting Order options.

First chart showing Periods immediately after the period ends

example; Q1 after Jan,Feb,Mar and H1 immediately after 1st half of the year is completed.

While the Second char

...

jagan · 2013-07-25

Hi,

This document helps in implementing Sheet level access based on the user using Section Access. I configured four users A, B, C and D and no password is required to login.

If you login as A, then you can see both Sheet1 and Sheet2.

If you log

...

richbyard · 2017-06-18

Inserting KPI indicators into tables is actually quite simple if you understand the HTML Unicode UTF-8 characters that are available for you to use and display with simple if conditions. These characters behave like any other text so applying conditi

...

Kushal_Chawda · 2015-09-18

It is often that we need to analyze the data on geo maps. There are many posts and links available to get started with the geo maps. Below are the various available links.

We can create the Google maps in the QlikView using google map APIs

Creating Geo-spatial dashboards in Qlikview

...

Sue_Macaluso · 2021-09-10

If you want to be selected/nominated to become a Qlik Community MVP, these tips will help get you there!

BE A POSITIVE ROLE MODEL

Work hard, demonstrate commitment, be respectful and supportive, keep a positive tone, show integrity, be accountable

...

stevedark · 2015-10-11

This example has been produced to accompany the blog post Sending Data In QlikView Alerts

There is a Qlik Sense version of this solution here: https://www.quickintelligence.co.uk/send-data-from-qlik-load-script/

This application demonstrates how alerts

...

Character Code	Character Desc	Character
9604	LOWER HALF BLOCK	▄
9605	LOWER FIVE EIGHTHS BLOCK	▅
9606	LOWER THREE QUARTERS BLOCK	▆
9607	LOWER SEVEN EIGHTHS BLOCK	▇
9608	FULL BLOCK	█
9609	LEFT SEVEN EIGHTHS BLOCK	▉
9610	LEFT THREE QUARTERS BLOCK	▊
9611	LEFT FIVE EIGHTHS BLOCK	▋
9612	LEFT HALF BLOCK	▌
9613	LEFT THREE EIGHTHS BLOCK	▍
9632	BLACK SQUARE	■
9650	BLACK UP-POINTING TRIANGLE	▲
9658	BLACK RIGHT-POINTING POINTER	►
9660	BLACK DOWN-POINTING TRIANGLE	▼
9668	BLACK LEFT-POINTING POINTER	◄
9679	BLACK CIRCLE	●
9680	CIRCLE WITH LEFT HALF BLACK	◐
9681	CIRCLE WITH RIGHT HALF BLACK	◑
9682	CIRCLE WITH LOWER HALF BLACK	◒
9683	CIRCLE WITH UPPER HALF BLACK	◓
9684	CIRCLE WITH UPPER RIGHT QUADRANT BLACK	◔
9685	CIRCLE WITH ALL BUT UPPER LEFT QUADRANT BLACK	◕
9698	BLACK LOWER RIGHT TRIANGLE	◢
9699	BLACK LOWER LEFT TRIANGLE	◣
9700	BLACK UPPER LEFT TRIANGLE	◤
9701	BLACK UPPER RIGHT TRIANGLE	◥
9733	BLACK STAR	★
9734	WHITE STAR	☆
9745	BALLOT BOX WITH CHECK	☑
9746	BALLOT BOX WITH X	☒
9754	BLACK LEFT POINTING INDEX	☚
9755	BLACK RIGHT POINTING INDEX	☛
9785	WHITE FROWNING FACE	☹
9786	WHITE SMILING FACE	☺
9787	BLACK SMILING FACE	☻
9829	BLACK HEART SUIT	♥
9830	BLACK DIAMOND SUIT	♦
9872	WHITE FLAG	⚐
9873	BLACK FLAG	⚑
9898	MEDIUM WHITE CIRCLE	⚪
9899	MEDIUM BLACK CIRCLE	⚫
9940	NO ENTRY	⛔
9978	TENT	⛺
9989	WHITE HEAVY CHECK MARK	✅
9995	RAISED HAND	✋
10003	CHECK MARK	✓
10004	HEAVY CHECK MARK	✔
10005	MULTIPLICATION X	✕
10006	HEAVY MULTIPLICATION X	✖
10007	BALLOT X	✗
10008	HEAVY BALLOT X	✘
10009	OUTLINED GREEK CROSS	✙
10010	HEAVY GREEK CROSS	✚
10011	OPEN CENTRE CROSS	✛
10026	CIRCLED WHITE STAR	✪
10060	CROSS MARK	❌
10062	NEGATIVE SQUARED CROSS MARK	❎
10067	BLACK QUESTION MARK ORNAMENT	❓
10068	WHITE QUESTION MARK ORNAMENT	❔
10069	WHITE EXCLAMATION MARK ORNAMENT	❕
10070	BLACK DIAMOND MINUS WHITE X	❖
10071	HEAVY EXCLAMATION MARK SYMBOL	❗

Qlik Community

popularResources

Getting Started with Qlik Community and More...

Incremental Load in Qlikview - Sources

24 days of Visualization

QAP (Qlik Analytics Platform)

Top 10 Viz tips - part IX - Qlik Connect 2025

Qlik Engine Health-Check Analysis (app included)

Creating a Scatter Chart

The second dimension... or how to use secondarydimensionality()

Missing Manual - ValueLoop() & ValueList()

Top 10 Viz tips - 2020 - part IV

Math & Statistics in Qlik Sense - app included

Chart Level Access by user

Sheets Security with Section Access

Qlik Sense Security integration - Security Rules and Section Access

Period Presets: Compare Periods on the fly

Sheet level access

Conditional Performance Indicators in Tables using HTML Unicode Chr() Values

Geo Maps in QlikView

How to Become a Qlik Community MVP

QlikView App: Send Data In QlikView Alerts

UserID	Sheet1	Sheet2
A	1	1
B	1	0
C	0	1
D	1	1