Management Console not able to connect to Snowflake with externalbrowser authentication

[nemoral]

If I run the connect/extract app on Qlikview Desktop and reload works fine, a new edge window opens the authentication happens and the app reloads.

Exactly on the very same server, logged in with the same account, which is the one that QMC users as well, the reload task fails

From script log:

 ODBC CONNECT TO *** (XUserId is ***, XPassword is ***)
 Error: Connector connect error: SQL##f - SqlState: S1000, ErrorCode: 38, ErrorMsg: [Snowflake][Snowflake] (38)
 Failed to authenticate a user by external browser: 31.
 Execution Failed
 Execution finished.

ANY IDEAS?

Thanks!

[Lucas_Gatling]

@nemoral  this is a Snowflake error and not a QlikView error. Check this thread out on Snowflake's community about the error message you are seeing: https://community.snowflake.com/s/article/Connection-to-Snowflake-via-ODBC-fails-with-error-when-usi...

[nemoral]

Thanks @Lucas_Gatling , the link does not apply for this case.

The script runs just fine when reloaded by Qlikview Desktop. BUT fails when very same script is run by QMC.

QMC is unable to use the ODBC snowflake connector like QV Desktop.

Help pls.

[Chip_Matejowsky]

@nemoral,

This looks to be an authentication issue with the service account running the QlikView Distribution Service (QDS). Suggest you try logging on to computer with the QV service account, open the QVW app that connects to Snowflake database and attempt to reload to see if you get the same error. If you do, work with your DBA to ensure the QV service account has the appropriate permissions to access the database.

Best Regards

[marcus_sommer]

I'm not sure if this is in general possible because the distribution-service is a service which runs in the background. I assume there would no user-interaction be possible. I'm far away from being an expert to this kind of admin-stuff but I have serious doubts that a successful communication between the service and snowflake and any external tool could happens ...

I assume you will need a different approach which worked with a normal (single-step) user-authentication and/or a second factor is enabled in another way ... maybe against the server IP.

[nemoral]

Hi @marcus_sommer ! Definitely this seems to be the case that QMC is unable. Meaning that the service should open an "externalbrowser" window same as Qlikview Desktop does when reloading from there.

OK. Let's detail little bit more the user authentication with example login id:

1. Logged in to server as user domain\qlikservice 

2. QDS service runs as user qlikservice@domain.company.com

3. Server login for QDS@servername is domain\qlikservice

ODBC user for snowflake connection is qlikservice@company.cloudcompany.com which is exactly the same user id logged in to Edge browser on server.

So when I open the app with Qlikview Desktop (on the very same server), it reloads, an external browser window (Edge) opens stating:

"Your identity was confirmed and propagated to Snowflake ODBC driver. You can close this window now and go back where you started from."

App connects and reloads without any issue.

If I schedule the same app for reload with QMC it just FAILS with the error previously described.

Hope this serves as proper description to @Chip_Matejowsky and @Lucas_Gatling  as well, Yes I am logged in with the service account.

Thanks guys!

[Chip_Matejowsky]

Hi @nemoral,

If you believe that this is a defect please open a case with Qlik Support and provide the expected results vs. the observed results.

Best Regards

[marcus_sommer · Accepted solution]

Maybe my understanding of what a service is wrong or a bit too limited but AFAIK a service has no GUI and could therefore not communicate with anything which requires a GUI and in my experience all from the service triggered actions inherit the option of being GUI-less. That's mainly not related to Qlik else to the way the OS handles the matter. There might be any possibilities to configure it differently but I don't think that's really trivial and probably there aren't many experts with experience to the topic.

Beside this what's the target to enforce an user-interaction with qmc-tasks? Usually the QlikView services are used to run completely automatically without any user-interaction and without a logged user on the (VM) machines. Every now and then the admin goes to the machine for any updates, backups, cleanings and similar stuff to what ever but no regular logon is needed. So what's the aim?

[nemoral]

Thank you Marcus, makes all the sense. Let's say I have been given the wrong authentication method for my setup by database guys.

I'll ask them to provide proper machine to machine one.

Thanks for solid rationale! and all for the answers!