Creating and managing OAuth clients

OAuth is a standard security protocol for authorization and delegation. It allows third party applications to access API resources without disclosing the end-user credentials. An OAuth client can obtain an authorization code and exchange it for an access token that can be used to access Qlik Cloud content through APIs.

Public and confidential clients

OAuth has two client types, public clients and confidential clients, to secure authorization between an application (the client) and the authorization server (Qlik Cloud).

Public clients

Public clients are applications that don’t use the client secret because they can’t maintain the confidentiality of the required credentials. Public clients in Qlik Cloud are often frontend applications like single-page applications with embedded analytics or a custom visualization extension in Qlik Sense requiring information about the end user to support the application lifecycle.

See : RFC 6749 Section 2.1: OAuth 2.0 Client Types.

Qlik Cloud supports confidential clients for traditional web (server-side) applications, and public clients for native and single-page applications using specific grant types.

Confidential clients

A confidential client is an application that maintains a client ID and a client secret in a secure manner without exposing them to unauthorized parties. Confidential clients can have access to protected resources because they are in possession of the client secret. An example of a confidential client is a web application with a secure backend interacting with Qlik Cloud APIs to orchestrate data refresh tasks or manage user access to content.

Authorization grant types

Qlik supports two authorization grant types, or flows: Authorization Code Flow and Authorization Code Flow with Proof Key for Code Exchange (PKCE). These flows are very similar, but they support different use cases.

Authorization code flow

Traditional web applications are server-side applications where the source code is not publicly exposed, therefore they can use the authorization code flow, which exchanges an authorization code for a token. Web applications that use this flow must be server-side because the application’s client secret is passed to the authorization server during the exchange for a token.

See: Authorization Code Flow for more details.

Authorization code flow with proof key for code exchange (PKCE)

Native and single-page applications cannot store a client secret because their source code is accessible through decompiling the app or viewing the app source through a browser, respectively. PKCE adds an additional layer of protection on public clients by requiring the use of a code verifier to obtain an access token.

See: Authorization Code Flow with Proof Key for Code Exchange (PKCE) for more details.

Limiting scopes available to OAuth clients

OAuth scopes provide a way to limit the amount of access that is granted to OAuth client apps. For example, an access token issued to a client app may be granted full access to protected resources, or just read access.

In Qlik Cloud, scopes provide a way of controlling client access to the available functionality and resources. Each scope grants a different level of access. Clients without scopes will not be able to access any resources.

Creating an OAuth client

OAuth clients are administered by tenant admins from the Management Console on the OAuth page.

With an OAuth client you can integrate your client application with Qlik Cloud.

To learn how to create an OAuth client for deployment and installation of the Qlik add-in for Microsoft Excel, see Creating an OAuth client for the Qlik add-in for Microsoft Excel.

Do the following:

1. In the Management Console, go to OAuth.

2. Click Create new.

3. Select a client type.

   Use Web for confidential clients and Single-page app or Native for public clients.

4. In the dialog, give the OAuth client a name.

5. Optionally, add a description.

6. Select any of the available scopes, either by scrolling or using the search field.

   Scope	Permission
   user_default	Full access to your account and content
   admin_classic	Full administrator access to your tenant See also: Deploying and administering Qlik Cloud Information noteNot supported with Single-page app and Native client types.
   admin.apps	Read and manage all apps in the tenant. See also: Managing apps
   admin.apps:export	Export all apps in the tenant See also: Exporting apps
   admin.apps:read	Read all apps in the tenant
   admin.automations	Read and manage all automations in the tenant See also: Managing automations
   admin.automations:read	Read all automations in the tenant
   admin.spaces	Read and manage all spaces in the tenant See also: Managing spaces
   admin.spaces:read	Read all spaces in the tenant
   apps	Read and manage your apps See also: Managing apps
   apps:export	Export your apps See also: Exporting apps
   apps:read	Read your apps
   automations	Read and manage your automations See also: Managing automations
   automations:read	Read your automations
   automl-experiments	Read and manage your ML experiments
   automl-deployments	Read and manage your ML deployments
   identity.email:read	Read your email address See also: Identity providers
   identity.name:read	Read your full name
   identity.picture:read	Read your profile picture See also: Identity providers
   identity.subject:read	Read your user subject identifier
   spaces.data	Read and manage your data spaces See also: Managing spaces
   spaces.data:read	Read your data spaces
   spaces.managed	Read and manage your managed spaces See also: Managing spaces
   spaces.managed:read	Read your managed spaces
   spaces.shared	Read and manage your shared spaces See also: Managing spaces
   spaces.shared:read	Read your shared spaces
   offline_access	Access resources while you are offline Information noteNot supported with the Single-page app client type.

   Information noteYou can use the All and Selected buttons above the list to show all scopes or only selected scopes.
   Information noteThe above list reflects the scopes supported in the initial release. A full list of scopes - including any scopes added after the initial release - can be found on the Qlik Developer Portal.

7. Enter one or more redirect URLs for the OAuth client application.

   Tip noteThe redirect URL is where the authorization server sends the user's browser after successfully authenticating and granting permission to the client application. For example, https://www.exampleapp.com/oauth/callback, where /oauth/callback handles authentication callbacks from the OAuth provider.

   Qlik Cloud will redirect the user back to the application after a successful authorization only if its URL is in the allowlist of redirect URLs. URLs must begin with https:// unless the domain is localhost, in which case it can start with http://. Native apps can also use the application specific link format, for example, exampleapp://.

   Click Add to add the redirect URL to the allowlist.

8. For client type Web or Single-page app, specify one or more allowed origins. Access to the application will only be granted if the URL is added to the allowed origins list.

9. For client type Web, you can enable Allow Machine-to-Machine (M2M) or Allow M2M user impersonation for automated system access without user interaction. M2M impersonation allows your application to act on behalf of users during authentication.

10. Click Create.

11. Click Copy to clipboard to save the client ID and client secret for later use. Store the client secret in a secure location. Click Done.

    Information notePublic clients will not have any client secret.

Creating an OAuth client for the Qlik add-in for Microsoft Excel

An OAuth client configuration is required to install the Qlik add-in for Microsoft Excel. The add-in is used by report developers to prepare report templates which control output of tabular reports from the Qlik Sense app.

For OAuth to work in the add-in, the OAuth client needs to be configured with the exact configuration shown below.

Do the following:

1. In the Management Console in Qlik Cloud, go to OAuth.

2. Click Create new.

3. In the Client type dropdown menu, select Single-page app. More fields will appear.

4. Insert a Name. The Description is optional.

5. At minimum, select the checkbox to include the user_default scope. You can include other scopes in the configuration, but without user_default, installation will not work.

   See Creating an OAuth client for a full description of each available scope.

6. In the Add redirect URLs field, insert the URL of your tenant, followed by the fixed string: /office-add-ins/oAuthLoginSuccess.html

   The result should look like this: https://YourServer/office-add-ins/oAuthLoginSuccess.html

7. Click Add.

8. In the Add allowed origins field, insert your tenant URL and click Add.

9. Click Create.

10. The Copy your Client ID window appears. You can choose to copy the Client ID to clipboard, or click Done to close the window.

After you have created the OAuth client, obtain the link to the updated manifest XML file from the Management Console. Go to the Settings page, and navigate to Feature control > Excel add-in within the Management Console. Use this link to deploy and install the add-in.

For more information about generating the manifest file, as well as deploying and installing an add-in, see:

• Deploying and installing the Qlik add-in for Microsoft Excel

• Managing installation manifests for the Qlik add-in for Microsoft Excel

Editing an OAuth client

You can rename an OAuth client, update the description, or manage the redirect URLs.

Do the following:

1. In the Management Console, go to OAuth.
2. Select the OAuth client that you want to edit. Click ... and then select Edit.
3. In the dialog, change the OAuth client options as required.
4. Click Save.

Publishing an OAuth client

Created OAuth clients are automatically bound to the tenant that created it. You can configure an OAuth client to be shared and available to all other tenants within a region. Third-party applications connecting to Qlik Cloud can then have the same client ID for all Qlik Cloud tenants. The application owner can rotate secrets and update the configuration without interaction from a tenant admin. Tenant admins won't need to manage credentials or know about any configuration details.

To allow other tenants to connect to an OAuth client, it needs to be published.

Do the following:

1. In the Management Console, go to OAuth.
2. Select the OAuth client that you want to publish. Click ... and then select Publish.
3. Click Publish.

When a user navigates to an external website that uses Qlik OAuth, they are prompted for tenant hostname, and subsequently also for user credentials, unless the user already has an active SaaS session. The first time login with an external OAuth client requires consent from a tenant admin. When approved, the new OAuth client is shown in the Management Console.

Consent method

You have two options for consent: Required and Trusted. With Required, authorization using the OAuth client will prompt for consent each time a new scope is requested for the user. With Trusted, the user is not prompted. You can only use Trusted for clients that aren't published. For published clients, the consent method is always Required.

Viewing and copying the OAuth configuration

In the OAuth section of the Management Console, select View OAuth configuration to display the configuration as a code snippet and a URL to copy.

Deleting an OAuth client

You can delete an OAuth client when it is no longer needed or to revoke access.

Do the following:

1. In the Management Console, go to OAuth.

2. Select the OAuth client that you want to remove, and then click Delete.

   Information noteYou can remove more than one OAuth client at a time.
3. Confirm that you want to delete the OAuth client.

Managing client secrets

You may need to add or remove a client secret if, for example, a client secret gets compromised or your security policy requires that you periodically update the client secret. You can also add multiple client secrets to prevent downtime in the application. For example, you can create a second secret, deploy the new secret in your client application, and then delete the old secret.

Do the following:

1. In the Management Console, go to OAuth.
2. Select the OAuth client that you want to manage. Click ... and then select Manage secrets.
3. In the dialog, do one of the following:
   • To add a new client secret, click Generate a new client secret.
   • To remove a client secret, click adjacent to the client secret.
4. Click Close.

Build an OAuth client application to access Qlik Cloud

After you have registered an OAuth client with Qlik Cloud, you can use the associated client ID and client secret in your own OAuth client application. Tutorials are available in the OAuth section of the Developer portal for building client applications using some of the most popular coding languages.