qlik sense security overview... · 2020-07-12 · qlik anticipates that subsequent events and...
TRANSCRIPT
Qlik Sense Security
Understand security basics of the new Sense platform
14 October, 2014
Magnus Berg
Master Principal Enterprise Architect
Legal Disclaimer This Presentation contains forward-looking statements, including, but not limited to, statements regarding the value and effectiveness of Qlik's products, the introduction of
product enhancements or additional products, Qlik’s partner and customer relationships, and Qlik's growth, expansion and market leadership, that involve risks,
uncertainties, assumptions and other factors which, if they do not materialize or prove correct, could cause Qlik's results to differ materially from those expressed or implied
by such forward-looking statements. All statements, other than statements of historical fact, are statements that could be deemed forward-looking statements, including
statements containing the words "predicts," "plan," "expects," "anticipates," "believes," "goal," "target," "estimate," "potential," "may", "will," "might," "could," and similar
words. Qlik intends all such forward-looking statements to be covered by the safe harbor provisions for forward-looking statements contained in Section 21E of the
Exchange Act and the Private Securities Litigation Reform Act of 1995. Actual results may differ materially from those projected in such statements due to various factors,
including but not limited to: risks and uncertainties inherent in our business; our ability to attract new customers and retain existing customers; our ability to effectively sell,
service and support our products; our ability to manage our international operations; our ability to compete effectively; our ability to develop and introduce new products
and add-ons or enhancements to existing products; our ability to continue to promote and maintain our brand in a cost-effective manner; our ability to manage growth; our
ability to attract and retain key personnel; the scope and validity of intellectual property rights applicable to our products; adverse economic conditions in general and
adverse economic conditions specifically affecting the markets in which we operate; and other risks and uncertainties more fully described in Qlik's publicly available filings
with the Securities and Exchange Commission. Past performance is not necessarily indicative of future results. The forward-looking statements included in this
presentation represent Qlik's views as of the date of this presentation. Qlik anticipates that subsequent events and developments will cause its views to change. Qlik
undertakes no intention or obligation to update or revise any forward-looking statements, whether as a result of new information, future events or otherwise. These
forward-looking statements should not be relied upon as representing Qlik's views as of any date subsequent to the date of this presentation.
This Presentation should be read in conjunction with Qlik's periodic reports filed with the SEC (SEC Information), including the disclosures therein of certain factors which
may affect Qlik’s future performance. Individual statements appearing in this Presentation are intended to be read in conjunction with and in the context of the complete
SEC Information documents in which they appear, rather than as stand-alone statements. This presentation is intended to outline our general product direction and
should not be relied on in making a purchase decision, as the development, release, and timing of any features or functionality described for our products
remains at our sole discretion.
© 2014 QlikTech International AB. All rights reserved. Qlik®, QlikView®, QlikTech®, and the QlikTech logos are trademarks of QlikTech International AB which have been
registered in multiple countries. Other marks and logos mentioned herein are trademarks or registered trademarks of their respective owners.
• Qlik Sense Security Overview
• Authentication and Authorization
• Proxy security
• User Directory Connectors
• Access Control
• Access control levels in QMC
• Rule Engine
• Section Access
• Standard vs Legacy mode
• Qlik Sense Security Overview
• Authentication and Authorization
• Proxy security
• User Directory Connectors
• Access Control
• Access control levels in QMC
• Rule Engine
• Section Access
• Standard vs Legacy mode
Qlik Sense Server Basic Platform
Repository
(QRS)
Scheduler
(QSS)
Engine
(QES)
Proxy
(QPS)
QMC Hub
Repository
(QRS)
Scheduler
(QSS)
Engine
(QES)
Proxy
(QPS)
QMC Hub
• Security administration is
done in the QMC.
• Streams, security rules,
management access rights,
Audit
Qlik Sense Server Management Console
Repository
(QRS)
Scheduler
(QSS)
Engine
(QES)
Proxy
(QPS)
QMC Hub
• Sense CA Certificate is
always installed
• Used to secure and
authenticate service
communication
• Encrypt connection strings
(LIB)
• CA Certificate can be
exported via QMC.
Qlik Sense Server Certificates
Repository
(QRS)
Scheduler
(QSS)
Engine
(QES)
Proxy
(QPS)
QMC Hub
• Proxy handles user
authentication against identity
providers
• Default Proxy SSL
communication uses the
internal CA cert.
• Recommendation!
Add a public certificate
thumbprint in the proxy!
Qlik Sense Server Proxy
Repository
(QRS)
Scheduler
(QSS)
Engine
(QES)
Proxy
(QPS)
QMC Hub
• User Authorization
• Repository service
synchronize users and groups
against directory providers.
Qlik Sense Server Repository
Repository
(QRS)
Scheduler
(QSS)
Engine
(QES)
Proxy
(QPS)
QMC Hub
• Engine handles Section
Access
• Section Access is authorized
against Repository
Qlik Sense Server Engine
• Qlik Sense Security Overview
• Authentication and Authorization
• Proxy security
• User Directory Connectors
• Access Control
• Access control levels in QMC
• Rule Engine
• Section Access
• Standard vs Legacy mode
• The Proxy is NOT a webserver.
• Proxy relays websocket communication between Engine/Repository and
the web browser.
• Proxy authenticates users against an Identity provider
• Authentication is done by an authentication module (default port 4244)
• Custom authentication modules can be created
• A “physical” proxy can have several virtual proxy instances
• Virtual proxy have header and ticket authentication support
Proxy
Identity provider User directory
Connectors (UDC)
Authentication Authorization
Proxy
(QPS)
Repository
(QRS)
Start Get
credentials
Verify user
credentials
Identity provider
Create
session
Access
control
QV User Dynamic Data
Reduction
Resource
presented to
user in Hub
or QMC
Authentication
Authorisation
System
rules
Proxy
(QPS) Proxy
(QPS)
Engine
(QES)
Repository
(QRS)
Qlik Sense access control logical flow
User Directory Connectors (UDC)
• Qlik Sense Security Overview
• Authentication and Authorization
• Proxy security
• User Directory Connectors
• Access Control
• Access control levels in QMC
• Rule Engine
• Section Access
• Standard vs Legacy mode
User Directory Connectors
• User Directory Connectors are managed in QMC
• Connects to several directory providers:
– Active Directory
– Generic LDAP
– SQL ODBC (database)
– XLS
– Local Computer
– Access DB
• Directory catalogs are synced into Sense database,
for performance and Node independence reasons
• Users and groups are utilized by the Repository access control system
– Management
– Authorization
Sync All • Remove Sync only existing users checkbox
• Have a small number of users (below 1500)
• Most of your user base is using Qlik Sense
Selective Sync
User Directory Connector setup
• Sync by use of LDAP filter
• “Tag” Qlik users by a attribute or group
• Good understanding of whom is using the system
Progressive Sync • Keep Sync only existing users checkbox
• Most unknown users
• Only active users in the system
• Qlik Sense Security Overview
• Authentication and Authorization
• Proxy security
• User Directory Connectors
• Access Control
• Access control levels in QMC
• Rule Engine
• Section Access
• Standard vs Legacy mode
Access Control
• There are two types of Access Control:
– Resource access control = App level authorization
– Administrator access control = Administrative access rights based on roles
• Access Control is based on Rules created and managed in the QMC
• Rules are created by the Rule Wizard associated with the task at hand
• Rules can be combinations, like (Group1 or Group2) and Group3
• Use audit management in QMC to validates the rules
• In addition there are Sync Rules used to synchronize data between nodes
User
Resource
Action
Environment
Reject
Accept
Resource
Stream
App
App Object
Data Connection
Extentions
Tasks
System Rules
Custom Properties
Content Library
Actions
Create
Read
Update
Delete
Publish
Change owneship
Export
Access control condition
Environment
Device
OS
IP
Request type
Security
Admin Deployment
Admin
Content
Admin
Audit
Admin
RootAdmin
Default administrator access levels
• Qlik Sense Security Overview
• Authentication and Authorization
• Proxy security
• User Directory Connectors
• Access Control
• Access control levels in QMC
• Rule Engine
• Section Access
• Standard vs Legacy mode
Removed Section Access fields
• USERID A username that Qlik will prompt when opening the Document
• PASSWORD A field that should contain an accepted password (clear text)
• SERIAL A field containing a number corresponding to the Qlik Serial Number
• NTNAME AccessPoint username or Ticketed identity
• NTSID A field that should contain a Windows SID
• NTDOMAINSID A field contain a string corresponding to Windows Domain SID
• ACCESS, currently only USER is used
• USERID The name of the user in the
format of UD\UID
• GROUP Group entries in the QRS
synced from a UD or groups injected at
the time of authentication.
• [REDUCTION] is the column to reduce
on (* still works)
• OMIT columns that should not be
available to the GROUP or USERID
Section Access Table
section access;
load * inline [
ACCESS, USERID,GROUP, REDUCTION, OMIT
USER, QTSEL\flp,*,3,Region
USER, *, QVnext,1,Region
USER, QVNCYCLES\bbr,*,2, Region
];
section access;
load * inline [
ACCESS, GROUP, REDUCTION, OMIT
USER, TestGrp1,1, Region
USER, TestGrp2,2, Region
];
Document properties does not exist
• DynamicReduceData : true
• InitialSelection : false
• StrictDynamicReduction : true
• Only work in server edition
• Desktop can’t open apps with section access
(there are no security implemented in Desktop)
• No document properties
• Still possible to lock your self out
Limitations
• Qlik Sense Security Overview
• Authentication and Authorization
• Proxy security
• User Directory Connectors
• Access Control
• Access control levels in QMC
• Rule Engine
• Section Access
• Standard vs Legacy mode
Legacy mode
• Backward compatible with v11
scripts
• Absolute server file system paths
in scripts
• Unsecure functions in script
Standard mode
• Data can only be loaded through lib
connect statements
• Data can only be stored using lib connect
statements
• Insecure functions (like Execute) disabled
• Insecure system variables disabled
Standard vs Legacy mode
• Authentication is handled by the Proxy
• Authorization is handled by the Repository
• A Sense CA Certificate is always installed
• Add a public certificate thumbprint into the proxy
• User Directory Connectors sync against directory providers
• Security management in QMC is done by rules (rule wizard)
• Section Access still works in Qlik Sense server (field names have changed)
• Section Access does not work in desktop
• Set Engine to Standard or Legacy mode depending on needs
Summary
Thank You