Setting up Qlik Data Gateway - Direct Access on a Windows server

You can also register Direct Access gateway automatically from the command line, without using the Administration activity center. This method uses a short-lived session token generated from an OAuth client.

Prerequisites

An API key with tenant admin permission to create and manage OAuth clients.

Registering the gateway with automatic registration

1. Generate a JSON Web Key (JWK) on the Direct Access gateway machine. This command creates private keys on the Direct Access gateway machine:

   ConnectorAgent.exe qcs generate_jwk

2. Copy the JWK returned by the command.

3. Using the API key, create an OAuth client for the gateway through the tenant admin API, providing the JWK you copied in the previous step.

   curl "https://<tenant-url>/api/v1/oauth-clients" -X POST -H 'accept: application/json' -H 'content-type: application/json' -H 'authorization: Bearer <api-key>' -d '{"appType":"web","clientName":"<client-name>","description":"","allowedScopes":["admin.direct-access-gateways:register_gateway","admin.direct-access-gateways:delete_gateway"],"allowedAuthMethods":["private_key_jwt"],"publicKeys":[<jwk>],"allowedGrantTypes":["client_credentials"]}'

4. Copy the client_id value returned in the response.

5. Set the OAuth client's consent method to trusted.

   curl "https://<tenant-url>/api/v1/oauth-clients/<client-id>/connection-configs/me" -X PATCH -H 'accept: application/json' -H 'content-type: application/json' -H 'authorization: Bearer <api-key>' -d '[{"op":"replace","path":"/consentMethod","value":"trusted"}]'

6. Create a registration assertion on the Direct Access gateway machine:

   ConnectorAgent.exe qcs generate_registration_assertion --tenant_url <tenant-url> --client-id <client-id>

7. Request an access token. This also triggers automatic creation of the bot user account used by the gateway.

   curl "https://<tenant-url>/oauth/token" -X POST -H 'content-type: application/x-www-form-urlencoded' -d "grant_type=client_credentials" -d "client_id=<client-id>" -d "client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer" -d "client_assertion=<assertion>" -d "scope=admin.direct-access-gateways:register_gateway admin.direct-access-gateways:delete_gateway"

8. Look up the auto-created bot user.

   curl "https://<tenant-url>/api/v1/users" -H 'accept: application/json' -H 'authorization: Bearer <API-key>'

9. Copy the ID of my-bot-client.

10. Create a "DAG Registration" role.

    curl "https://<tenant-url>/api/v1/roles" -X POST -H 'accept: application/json' -H 'content-type: application/json' -H  'authorization: Bearer API-key' -d '{"name":"DAG Registration","description":"Role for registering a gateway","assignedScopes":["admin.direct-access-gateways:register_gateway", "admin.direct-access-gateways:delete_gateway"]}'

11. Assign tenant-level roles to the bot user.

    curl "https://<tenant-url>/api/v1/users/<bot-user-ID>" -X PATCH  -H 'accept: application/json' -H 'content-type: application/json' -H  'authorization: Bearer <API-key>' -d ' [ { "op": "replace", "path": "/assignedRoles", "value": [ { "name": "DAG Registration" } ] } ]'

12. Get the Direct Access Gateway space.

    curl "https://<tenant-url>/api/v1/spaces" -H  'authorization: Bearer <API-key>'

13. Copy the Direct Access Gateway space ID.

14. Add the bot user to the space with Can edit permission.

    curl "https://<tenant-url>/api/v1/spaces/<DAG-space-ID>/assignments" -X POST -H 'accept: application/json' -H 'content-type: application/json' -H  'authorization: Bearer <API-key>' -d '{"assigneeId": "<Bot-user-ID>","roles": ["consumer","dataconsumer","producer"], "type": "user"}'

15. In case the existing assertion has expired, generate a new one.

    ConnectorAgent.exe qcs generate_registration_assertion --tenant_url <tenant-url> --client-id <client-ID>

16. Register the gateway:

    ConnectorAgent.exe qcs register_gateway --tenant_url <tenant-url> --gateway_name <gateway-name> --gateway_description <gateway-description> --space_name <space-name> --client-id <client-ID> --assertion <assertion>

Removing an automatically registered gateway

Use the following steps to unregister a gateway that was registered using the automatic, session token-based method described above. These steps also remove the OAuth client, bot user, and role that were created for it.

1. Generate an assertion, as described in step six of Automatic gateway registration using a session token.

2. Delete the gateway:

   ConnectorAgent.exe qcs delete_gateway --tenant_url <tenant-url> --gateway_name <gateway-name> --client-id <client-ID> --assertion <assertion>

3. Delete the JWK.

   ConnectorAgent.exe qcs delete_jwk

4. Look up the bot user account that was created for the gateway.

   curl "https://<tenant-url>/api/v1/users" -H 'accept: application/json' -H 'authorization: Bearer <api-key>'

5. Copy the bot ID.

6. Delete this bot user account.

   curl -X DELETE "https://<tenant-url>/api/v1/users/<bot-user-ID>" -H "Authorization: Bearer <api-key>"

7. Look up the “DAG Registration” role that was created for the gateway.

   curl "https://<tenant-url>/api/v1/roles?limit=1&filter=(name eq \"DAG Registration\")" -H "Authorization: Bearer <api-key>"

8. Copy the role ID.

9. Delete this role.

   curl -X DELETE "https://<tenant-url>/api/v1/roles/<role-ID>" -H "Authorization: Bearer <api-key>"

10. Delete the OAuth client.

    curl -X DELETE "https://<tenant-url>/api/v1/oauth-clients/<client-ID>" -H "qlik-confirm-delete: <client-ID>" -H "Authorization: Bearer <api-key>"