Qlik Web Connectors - an introduction for Enterprise Users

[Bjorn_Wedbratt]

Certain users may have particular requirements and concerns about what software they allow to run on their machines - this page attempts to explain the main aspects of Qlik Web Connectors which could be useful to enterprise users.

Prerequisites

The latest release of Qlik Web Connectors should run on any Windows PC which has the Download .NET Framework 4.7.2 installed. Please note however that:

Qlik Web Connectors should currently work with any version of QlikView or Qlik Sense.

Note: For most of the connectors available so far, Qlik Web Connectors needs to connect to the internet in order to download data from whichever API you are interested in - therefore if you have a personal or corporate firewall preventing this it will not work - we do have some features (see Outgoing Connections further down ) which might help you configure this.

More information under Qlik Web Connectors - Help Site 
 

A Qlik Web Connectors Primer

The following diagram gives a high level overview of where Qlik Web Connectors sits in relation to QlikView and the APIs it connects to:

In particular, it is useful to appreciate the following:

• Qlik Web Connectors is simple to install/setup (see Getting Started with Qlik Web Connectors ). Actually, there is no installer and no registration of components (e.g. COM or in the GAC (Global Assembly Cache)).
  • Qlik Web Connectors is delivered simply as a zipped folder which you unzip (we recommend to c:\Qlik Web Connectors\ or another root drive) and run the exe. You may need to first 'unblock' the zip file see Unblocking the Qlik Web Connectors zip distribution 
  • Note that we would not recommend including the version number in the folder as it makes upgrading more challenging - for example the windows service will need to be un-registered and re-registered with each upgrade.

• Qlik Web Connectors works by running a simple, lightweight web server on your local machine. QlikView requests data from HTTP/HTTPS end points during processing of the load script which in turn triggers Qlik Web Connectors to request data from the API in question. More on these items below.

• You can set up a Windows Service version of Qlik Web Connectors, by running a simple batch file as explained in Setting up the Qlik Web Connectors Windows Service ), which is useful (necessary) when running alongside QlikView Server. 
  • See Running Qlik Web Connectors under a standard User Account for instructions on how to configure Qlik Web Connectors to use a standard (non administrator) user account

The Qlik Web Connectors Web Server

Qlik Web Connectors  works by running a small, lightweight web server. By default, when you run the Qlik Web Connectors.exe (or the Windows Service version - Qlik Web ConnectorsSVC.exe), Qlik Web Connectors will start 'listening' on:
http://localhost:5555/web 

For further explanation on how to use this end point to check the status of Qlik Web Connectors, see Checking the status of Qlik Web Connectors 

If necessary, the port number can be changed as described in Changing the listening port number for Qlik Web Connectors (this page also gives some notes on how you can check if other programs have already 'claimed' this port).

Important! As a security measure, the local web server only responds to requests coming from the local machine Qlik Web Connectors is installed on, by default. To configure the local web server for remote requests, see (link)  
 

Outgoing Connections

Qlik Web Connectors makes outgoing requests to various APIs. For example, the Twitter Connector makes out going requests to the Twitter REST API  'on behalf of QlikView', returning the results in a format which can be natively parsed and read by QlikView.
 

End Points/URLs

Where possible, each connector now advertises the end points it needs to make out going connections to. This information is found on the 'About' tab > Permissions of each connector. Example on the Twitter Connector (you should always check this tab for the latest/current version of the connector you are using):

This is useful if you would like to configure an outgoing proxy server or firewall to only allow traffic to the specific end points Qlik Web Connectors needs to connect to.
 

Proxy Authentication

If you connect to the Internet through a proxy then you might find you need to edit <Proxy> section in deploy.config and change UseProxy to true:

<Proxy>
    <UseProxy>true</UseProxy>
    <ProxyAddress></ProxyAddress>
    <ProxyUsername></ProxyUsername>
    <ProxyDomain></ProxyDomain>
    <ProxyPassword></ProxyPassword>
</Proxy>

If you still experience proxy authentication errors (often with a 407 HTTP error code), you may provide additional information, such as a proxy username and password.
For more information see Advanced configuration of Qlik Web Connectors 
 

HTTP Headers/User Agents

All of the outgoing calls from Qlik Web Connectors should have the user agent: Qlik Web Connectors(gzip)

As well as an additional http header: Qlik Web Connectors: true

You may be able to use these to further tie down the access Qlik Web Connectors is permitted.

PLEASE NOTE: An important exception to this is that many connectors use OAuth authentication in which case the user is typically directed to a login page hosted by the API provider (e.g. a Twitter login web page or a Google Service login web page. In this case Qlik Web Connectors simply hosts a browser control to display this and is not able to set the above headers. The user agent in this case will then start 'Mozilla/4.0'.

If you are having problems with these elements please contact us if you need details about the urls being browsed to so that, for example, you can allow access through your proxy or firewall.

 

Revoking Qlik Web Connectors Access To Your Data

Many APIs now use OAuth for authentication and the sites which manage these APIs often have a page which lists which applications you have given permission to access your data.

See Revoking Qlik Web Connectors access to your data for a list of locations where you should find applications you have allowed access to your data (including Qlik Web Connectors) and can often revoke the access.
 

Deploying From Development to Test/Production Servers

When you install Qlik Web Connectors on a new machine you typically need to ensure that you have authenticated with any connectors which are being used. If you are deploying from a desktop/development environment to a server this step can be a little cumbersome. For details see Qlik Web Connectors Quick Deployment of Settings from Desktop to Server 
 

Storage and Security of Credentials

Some of the Qlik Web Connectors connectors require you to enter your credentials to authenticate and/or API keys in order to gain access to the specific API. There are two ways that the access tokens and passwords can be used:

• use the authenticated access tokens and passwords from within Qlik Web Connectors (recommended)
• embed access tokens and passwords in your application's load script

If the access tokens are embedded in your application's load script, then once these are distributed they would also need to be properly secured.

Where authentication is used from within Qlik Web Connectors, then security details are stored in a ConnectorSettings.xml file for each connector. The files are located in the folder Qlik Web Connectors\App_Data\[User]\ConnectorSettings.xml and although Qlik Web Connectors will encrypt them it is important (and also your responsibility) to ensure that there is sufficient security to adequately protect these files and ensure they are only accessible by individuals you select.