Configuring a proxy for Qlik License Service communication in Qlik Sense Enterprise on Windows

You can handle the communication between the Qlik License Service and the License Back-end with a proxy.

The Qlik License Service is included in Qlik Sense Enterprise February 2019 and later releases and is used when Qlik Sense is activated using a signed key license. The Qlik License Service stores the information about the license, and communicates with a License Back-end Service, hosted by Qlik, for product activations and entitlement management. Port 443 is used for accessing the License Back-end Service and retrieving license information.

In a Qlik Sense Enterprise on Windows multi-node deployment, the Qlik License Service is installed on every node. You can manage the status of the Qlik License Service by starting and stopping the Qlik Sense Service Dispatcher, listed in the list of services running in the Windows machine.

With Qlik Sense June 2019 or later you can configure the communication between Qlik License service and the Qlik License Back-end to be handled by a proxy.

In Qlik Sense Enterprise on Windows, configuration of a proxy for the Qlik License Service is done using command line parameters. Both HTTP and HTTPS schema are supported.

With Qlik Sense June 2020 or later NTLM and basic authentication capabilities to the licenses service when communicating over a HTTP tunnel are available. This allows you to require authentication on tunneling proxies to configure a more secure environment.

Do the following:

1. Stop the Qlik Sense Service Dispatcher, which handles the execution of the Qlik License Service.
2. Navigate to the services.conf file, which by default is located in:

%Program Files%\Qlik\Sense\ServiceDispatcher\services.conf

3. Locate the section [licenses.parameters], which by default contains the following lines:

[licenses.parameters]
-qsefw-mode
-app-settings="..\Licenses\appsettings.json"


4. Add the line -proxy-uri=http://myproxy.example.com:8888 as shown below:

[licenses.parameters]
-qsefw-mode
-proxy-uri=http://myproxy.example.com:8888
-app-settings="..\Licenses\appsettings.json"

Where "http://myproxy.example.com" is the address of your company's proxy, and "8888" is the port used by the proxy.

Information noteYou can specify an IP address rather than a domain name as the proxy URI, for example -proxy-uri=http://10.76.124.124:1337.

5. If your external proxy requires an encrypted password to be applied, browse to %ProgramFiles%\Qlik\Sense\Licenses and run Encrypt-Password.ps1 [password for proxy access].

   Example:  

   Encrypt-Password.ps1 123456

   Copy the generated encrypted password and use it in the next step.

6. To require authentication on tunneling proxies add the following lines to the services.conf file:

   • If encryption is required for your proxy password:

     -proxy-uri=[the uri of the proxy]
     -proxy-auth-mode=ntlm|basic|(leave empty for no authentication)
     -proxy-user=[username without domain]
     -proxy-encrypted-password=[password]
     -proxy-domain=[the domain] (only for NTLM)

   • If you are not using encryption:

     -proxy-uri=[the uri of the proxy]
     -proxy-auth-mode=ntlm|basic|(leave empty for no authentication)
     -proxy-user=[username without domain]
     -proxy-password=[password]
     -proxy-domain=[the domain] (only for NTLM)

7. Save and close the services.conf file.
8. Restart the Qlik Sense Service Dispatcher.
9. If you have a multi-node installation, repeat these steps for all the nodes in your installation.