Kerberos authentication with Qlik Sense

[Damien_Villaret]

This article explains the steps to configure Kerberos with Qlik Sense. However, it's important to note that the actual setup, implementation, and configuration of Kerberos for Qlik is the responsibility of the customer.

For another set of instructions, see Seamless Single SignOn (SSSO) into Qlik Sense 

Note: The following will require appropriate permissions in Active Directory to add Service Principal Names on the account running Qlik Sense services.

A Service Principal Name may be registered using the following command:

setspn -A http/HOST serviceaccount

where

• HOST is the name of the server hosting Qlik Sense.
• serviceaccount is the account running Qlik Sense services.

Steps: 

1. Open a command prompt with administrative privileges and type :

Windows Server 2008 / R2 and Windows Server 2012

setspn -U -S http/QlikServer1 COMPANYX\serviceAccount
setspn -U -S http/QlikServer1.companyx.local COMPANYX\serviceAccount

2. Go to the QMC > Proxy > Edit
Check the 'Enable Kerberos' checkbox.

NOTE: An SPN must be set for both the short hostname and FQDN for the target Qlik Sense server for Kerberos to work correctly. This is not related to URLs configured in the Web Client allowlist under the Virtual Proxy configuration.

For more information about Service Principal Names see: http://technet.microsoft.com/en-us/library/cc961723.aspx

Related Content:

Seamless Single SignOn (SSSO) into Qlik Sense 
Qlik Sense Mobile and Kerberos

[ift_isabelle]

My Monitoring data connection keep failing, probably because of the Kerberos authentication.

I changed my user agent to mozilla and enabled Kerberos (as mentioned in the documentation).
Now I get an error "HTTP protocol error 401 (Unauthorized): 'Negotiate' authentication schema provided by the web-service is not supported or your credentials are not valid."

Any ideas how to fix this? 

[Sonja_Bauernfeind]

Hello @ift_isabelle 

Kerberos is not supported for use with the REST connector (which is what the Monitoring apps use).

See HTTP protocol error 401 Monitoring Apps or other app reloads fails with Kerberos Authentication in Q....

If you'd like to see this reviewed by our developers for a feature improvement, please leave an idea in: https://community.qlik.com/t5/Suggest-an-Idea/idb-p/qlik-ideas. Feel free to tag me here after you have done so, so that I can give it a vote!

[ift_isabelle]

Ok, but how do I fix my connections then?
And why does this standard functionality kill another standard functionality?

[Sonja_Bauernfeind]

To work around the REST connector not supporting Kerberos, we recommend using JWT authentication instead: Qlik Sense: Modify REST connections for Monitoring Apps to use JWT authentication 

I'd still recommend logging an idea. I haven't seen another customer request this feature in our Ideas forum, so this would greatly help our developers understand the interest in working on Kerberos as a supported authentication method for the REST connector. 

[ift_isabelle]

Hi Sonja,

thanks for your reply, one quick question: We also use the Qlik Sense mobile app.
Will this work with the kerberos auhtentication?

Kind regards,

Isabelle

[Sonja_Bauernfeind]

Hello @ift_isabelle 

Qlik Sense Mobile supports Kerberos, yes. See Qlik Sense Mobile and Kerberos .

Note that for assistance with the setup it may be necessary to contact our Consulting Services / Expert Services if you require more detailed help.

[humansoft]

The Idea is here. Please vote! 😀