Configuring Qlik Cloud Connection

ConnectReport supports connections to Qlik Sense Enterprise tenants in the Qlik Sense Cloud platform.

To get set up, refer to this guide. The steps outlined in this guide take about 30 minutes to complete.

Overview

This guide covers configuring a Qlik Sense Enterprise SaaS data connector in ConnectReport. You will configure a Qlik Sense Enterprise SaaS identity provider in order to create authenticated, signed requests from ConnectReport to your Qlik Sense Cloud tenant, and complete a few other steps to create a secure connection to your Qlik tenant.

Steps

  • Create RSA key pair
  • Configure JWT IDP in Qlik Sense Enterprise Cloud
  • Create web integration
  • Set web integration ID and upload private key in ConnectReport
  • Test the connection

Prerequisites

You will need the following to complete this guide:

  • An OpenSSL distribution installed on your local system. You can validate whether OpenSSL is installed by running the program from your command line or bash: openssl
  • A Qlik Sense Enterprise SaaS tenant
  • A ConnectReport installation. Refer to the install guide here if you have not already

Create RSA key pair

You’ll need to generate an RSA key pair ConnectReport and Qlik Sense Enterprise Cloud to securely communicate and verify claims about user identities. You will use the RSA keys to configure your Qlik Sense Enterprise tenant’s JWT authentication in the following step.

Run the following OpenSSL command in your preferred command line to create a private key:

openssl genrsa -out privatekey.pem 4096

We recommend that you follow key management best practices and store your private key securely, as it will be capable of generating credentials.

ConnectReport will need the private key in PKCS #8 format. To convert the private key, run the following:

openssl pkey -in privatekey.pem -out privatekey-pkcs8.pem

Create a public key based on your private key. OpenSSL will prompt you for various information, but you only need to enter a Common Name. For the common name, choose something identifiable such as “connectreport-dev”.

openssl req -new -x509 -key privatekey.pem -out publickey.cer -days 365

Configure JWT identity provider in your Qlik Sense Enterprise SaaS tenant

In this step we will use the public key generated to tell your Qlik tenant how to verify credentials sent by ConnectReport, and complete the relevant fields for your Qlik Sense IDP configuration.

Navigate to the Management Console of your Qlik Sense Enterprise SaaS tenant and click Identity provider.

Click Create new

For Type select “JWT”

Carefully copy the contents of the public key you generated in step one. You should open the contents of your clipboard to validate there are no stray line breaks. Alternatively, if you are on bash, run cat publickey.cer | pbcopy to copy the contents. Paste the contents into the certificate field.

For Issuer, enter https://connectreport

For Key ID, enter cr_qlik_jwt

Configured JWT IDP

Click Create

Create web integration

A web integration is needed for ConnectReport to successfully make requests to your Qlik Sense Enterprise SaaS tenant.

From the Management Console of your Qlik Sense Enterprise SaaS tenant, under Integrations, click Web.

Click Create new

Enter a name such as “ConnectReport”

Add the origin https://localhost. ConnectReport will make requests from the localhost origin.

Click Create. Take note of the ID, you will need it in a subsequent step.

Set web integration ID and private key in ConnectReport

Navigate to the management console of your ConnectReport server.

Under Data Connectors, navigate to Qlik.

In Host URI, enter the URI of your Qlik Sense Enterprise tenant. It will look something like tenant.region.qlikcloud.com

Set Web integration ID to the ID of the web integration you created above.

Under IDP key, upload the PKCS #8 formatted private key you created above.

For API key expiry days, set it to a value that meets your needs. The ConnectReport repository will store API keys it creates for Qlik Sense SaaS users, and their expiry will be determined by this value.

ConnectReport will generate API keys for users with the sub claim based on either the user’s ConnectReport username or, if set, the user’s Qlik Sense username. Ideally, your usernames should map directly to Qlik Sense usernames so that you don’t have to configure anything additional. However, you may configure Qlik Sense usernames on a per-user basis from the Users section of the ConnectReport management console.

Test the connection

Navigate to the ConnectReport portal and create a template.

From the sidebar, choose Qlik Sense.

Validate that the app list loads and shows the apps you expect to see.

Your users should now be able to drag visualization and data into templates using data from your Qlik tenant.