Skip to main content
Announcements
Have questions about Qlik Connect? Join us live on April 10th, at 11 AM ET: SIGN UP NOW

Qlik Sense: Logout button not working when accessing through a reverse proxy

No ratings
cancel
Showing results for 
Search instead for 
Did you mean: 
Damien_Villaret
Support
Support

Qlik Sense: Logout button not working when accessing through a reverse proxy

Last Update:

Jan 24, 2023 4:23:11 AM

Updated By:

Sonja_Bauernfeind

Created date:

Feb 21, 2018 8:44:31 AM

The logout button in Qlik Sense Hub does not work when using Qlik Sense through a reverse proxy.
Looking into the browser developer tools (F12), the logout URL points directly to the Qlik Sense server name instead of the reverse proxy name.

 

Resolution

Solution for September 2018 and later

The name that the logout URL must be rewritten to must be specified in the X-Forwarded-Host header.
This header must be added to the reverse proxy configuration rules.

Below is an example for IIS, however, the same logic applies to other kinds of reverse proxies:

<rule name="QlikReverseProxyAll" enabled="false" patternSyntax="ECMAScript">
                    <match url="(.*)" />
                    <conditions logicalGrouping="MatchAll" trackAllCaptures="false">
                    </conditions>
                    <action type="Rewrite" url="https://qlikserver1.domain.local/{R:0}" />
                    <serverVariables>
                        <set name="HEADER_X-Forwarded-Host" value="10.76.200.11" />
                    </serverVariables>
                </rule>

In September 2019 and later, if SSL off-loading is used (Use of HTTP between the reverse proxy and the Qlik Sense server and of HTTPS between the reverse proxy and the end user), then the X-Forwarded-proto or the Forwarded header can be used.

<rule name="QlikReverseProxyAll" enabled="false" patternSyntax="ECMAScript">
                    <match url="(.*)" />
                    <conditions logicalGrouping="MatchAll" trackAllCaptures="false">
                    </conditions>
                    <action type="Rewrite" url="http://qlikserver1.domain.local/{R:0}" />
                    <serverVariables>
                        <set name="HEADER_X-Forwarded-Host" value="10.76.200.11" />
                        <set name="HEADER_X-Forwarded-proto" value="https" />
                    </serverVariables>
                </rule>

Alternative:

<rule name="QlikReverseProxyAll" enabled="false" patternSyntax="ECMAScript">
                    <match url="(.*)" />
                    <conditions logicalGrouping="MatchAll" trackAllCaptures="false">
                    </conditions>
                    <action type="Rewrite" url="http://qlikserver1.domain.local/{R:0}" />
                    <serverVariables>
                        <set name="HEADER_Forwarded" value="host=10.76.200.11;proto=https" />
                    </serverVariables>
                </rule>




Workaround

Workaround for June 2018 and earlier:

You must create an entry in the Reverse Proxy host file to point the external DNS name to the Qlik Sense server.

From the client:

externaldnsalias will point to the reverse proxy server.

From the reverse proxy server:
externaldnsalias will point to the Qlik Sense server.


In the below example, qlikserver4.domain.local is the external DNS alias.

The following configuration example is for IIS (This is using global rules set in the applicationHost.config file, but the same can be done using website rules in web.config):

<rewrite>
            <globalRules>
                <clear />
                <rule name="QlikReverseProxyAll">
                    <match url="(.*)" />
                    <conditions logicalGrouping="MatchAll" trackAllCaptures="false" />
                    <action type="Rewrite" url="https://qlikserver4.domain.local/{R:0}" />
                </rule>
                <rule name="AuthForwarding">
                    <match url="form/" />
                    <conditions logicalGrouping="MatchAll" trackAllCaptures="false" />
                    <action type="Rewrite" url="https://qlikserver4.domain.local:4244/{R:0}" />
                </rule>
                <rule name="Windows_Auth">
                    <match url="/windows_authentication/" />
                    <conditions logicalGrouping="MatchAll" trackAllCaptures="false" />
                    <action type="Rewrite" url="https://qlikserver4.domain.local:4244/{R:0}" />
                </rule>
</globalRules>
         </rewrite>


On the reverse proxy server, in the host file (in C:\Windows\System32\drivers\etc\ for Windows), add the following line:

172.16.16.100 qlikserver4.domain.local

172.16.16.100 is the IP of the Qlik Sense server.

When you ping qlikserver4.domain.local on the reverse proxy server, you should see the IP address of the Qlik Sense server.

When you ping qlikserver4.domain.local on the client, you should see the IP address of the reverse proxy machine.

Once the above settings performed, you should now be able to log out from the hub.


Internal Investigation ID(s):

QLIK-87698
 

Labels (1)
Comments
crmtdoo
Contributor
Contributor

Hello,

We have the same problem on the F5 reverse proxy. Do you have solution for F5 reverse proxy?

Best regards.

Sonja_Bauernfeind
Digital Support
Digital Support

Hello @crmtdoo 

The instructions in this article should provide you with a basic idea of how to begin troubleshooting/configuring your proxy. 

If you require additional assistance, I would recommend posting about your issue directly in our Integration forum - or if you need direct help, our professional services can be engaged to assist.

All the best,
Sonja 

neerajthakur
Creator III
Creator III

@Damien_Villaret How to reach the point where this rule is present, i.e. steps to reach it before changing.

Sonja_Bauernfeind
Digital Support
Digital Support

Hello @neerajthakur 

The instructions in this article should provide you with a basic idea of how to begin troubleshooting/configuring your proxy. 

If you require additional assistance, I would recommend posting about your issue directly in our Integration forum - or if you need direct help, our professional services can be engaged to assist.

All the best,
Sonja 

Version history
Last update:
‎2023-01-24 04:23 AM
Updated by: