Limiting Access to Vizlib Management Console Admin Account
This article describes how one can limit or disable possibility to use in-built admin account to lock access to Vizlib Management Console. This might be a requirement when there is a need to open Vizlib Server globally, as the admin account supports only username + password authentication mechanism with no 2FA.
Functionality is available for both Enterprise and Qlik Cloud versions (Docker and Windows). The premise is the same, but the configuration details vary.
There are three environment variables that can be defined to control this behavior.
- VIZLIB_VMC_USER_DISABLED - when set to true, the possibility to log in as VMC admin is disabled
- VIZLIB_VMC_USER_DISABLED_EXTERNALLY - when set to true, the possibility to log in as VMC admin for machines other than localhost (so from the server where Vizlib Server is installed) or with IP defined in the whitelist, is disabled
- VIZLIB_VMC_USER_IP_WHITELIST - semicolon separated list of IP addresses in IPv4 format, that should be accepted apart from a localhost IP. An example could be 4.2.12.10; 192.100.50.10; 8.10.22.250. It only has an effect in combination with VIZLIB_VMC_USER_DISABLED_EXTERNALLY set to true.
When admin access is disabled, the only option available is using Qlik's session.
This topic contains the following sections:
Defining on a Windows Environment
The easiest option is to modify content of the setup.xml file located in the C:\Program Files\VizlibServer folder. An entry like this one should be added <env name="VIZLIB_VMC_USER_DISABLED" value="true" /> in order to set VIZLIB_VMC_USER_DISABLED environment variable to true. It should be added below already existing variables.
Important: Do not remove already existing entries from setup.xml file.
In order for the changes to take an effect, Windows service Vizlib Server should be restarted from the Windows Services tool.
Defining on a Docker Container
Environment variables should be added to the docker-compose file used when creating the containers. An example entry would look like this: VIZLIB_VMC_USER_DISABLED: 'true'
After making changes to the docker-compose file, following command has to be executed for the changes to apply: docker- compose up -d