We’ve configured NPrinting 17.3 with a custom virtual proxy in Qlik Sense Enterprise (November 2019) to handle external user authentication. The setup works fine for internal users, but external users consistently receive ‘Authentication failed’ errors when trying to access shared reports through NPrinting.
Our custom virtual proxy configuration uses header authentication:
Authentication method: Header
Header authentication header name: X-Qlik-User
Header authentication dynamic user directory: EXTERNAL
The NPrinting connection URL points to our custom virtual proxy endpoint (https://qlikserver/customvp/), and we’ve verified the user directory mapping between Qlik Sense and NPrinting matches exactly. Internal users from the INTERNAL directory work perfectly, but EXTERNAL directory users fail immediately.
Has anyone encountered this specific scenario with custom virtual proxies and NPrinting? The error logs don’t provide much detail beyond authentication failure.
I’ve seen similar issues with custom virtual proxies and NPrinting. First thing to check: are your external users properly synchronized in both systems? The user directory mapping needs to be exact, including case sensitivity. Also verify that the virtual proxy is actually passing the authentication header correctly. You can test this by accessing the Qlik Sense hub directly through the custom virtual proxy URL with an external user account.
Here’s the complete solution addressing all three critical configuration areas:
1. Custom Virtual Proxy Configuration
Your virtual proxy settings need these specific adjustments for NPrinting compatibility:
Authentication method: Header
Header authentication header name: X-Qlik-User
Header authentication dynamic user directory: $ud
Change from hardcoded ‘EXTERNAL’ to ‘$ud’ - this allows NPrinting to specify the user directory dynamically in the authentication header.
2. NPrinting Connection URL and Authentication
In NPrinting Console, edit your Qlik Sense connection:
- Connection URL: https://qlikserver/customvp/ (your current setting is correct)
- User directory: Leave blank or set to match exactly
- Important: Enable ‘Use same user for all tasks’ temporarily to test if authentication works at all
Then verify certificate trust:
- Export the Qlik Sense server certificate from QMC (Certificates section)
- Import into NPrinting server’s Trusted Root Certification Authorities store
- Restart NPrinting services after certificate import
3. User Directory Mapping Between Qlik Sense and NPrinting
The mapping must be bidirectional and exact:
In Qlik Sense QMC:
- User Directory Connector for EXTERNAL must be active
- Users must exist with format: EXTERNAL\username
In NPrinting:
- Import users from the same source or manually create matching EXTERNAL\username format
- Verify in NPrinting Users section that directory prefix matches exactly
Additional Critical Settings:
Virtual Proxy Advanced Settings:
- Session cookie header name: X-Qlik-Session
- Load balancing nodes: Include all Qlik Sense nodes if clustered
NPrinting Connection Advanced:
- Timeout settings: Increase to 300 seconds for initial connection
- Enable ‘Trust server certificate’ if using self-signed certificates
Testing Process:
- Test direct Qlik Sense hub access through custom virtual proxy URL as external user
- Verify ticket generation works: https://qlikserver/customvp/qps/ticket?xrfkey=1234567890123456
- Test NPrinting connection using ‘Verify Connection’ in NPrinting Console
- Run a simple scheduled report for an external user
The root cause is typically the combination of hardcoded user directory in the virtual proxy and missing certificate trust. The ‘$ud’ parameter allows NPrinting to pass the correct directory dynamically, while certificate trust enables proper ticket validation. After implementing these changes, external users should authenticate successfully through NPrinting.