topic Re: Convert QS local users to AD Users in Management & Governance

Convert QS local users to AD Users

Gestion-PSD — Mon, 21 Oct 2019 14:35:13 GMT

Hi!

We'he a QS Enterprise installation with local users and we're going to insert this server on a domain with an Active Directory.

This AD had already the same QS users that the local server. We'd read about how to deal with this situation (https://qliksupport.force.com/articles/000050442?_ga=2.101025537.1048288763.1571653526-1802325108.1527756870) but we aren't sure about the right steps secuence:

Option A:

Insert server in Domain an AD
Activate AD synchroization
Follow the steps on article cited above

or Option B:

Insert server in Domain an AD
Follow the steps on article cited above
Activate AD sync.

I think in Option A it's possible to have duplicated users with same userID and domain, and We don't know how QS will response.

Otherwise, in Option B it's possible than users can't authenticate in AD because Qlik isn't sync. with AD.

Coudl you bring some ligth about this?

Thanks!

Re: Convert QS local users to AD Users

Levi_Turner — Tue, 22 Oct 2019 09:50:13 GMT

Option B is cleaner. Join the domain, remap the users at the PostgreSQL layer, then the users will seamlessly switch over to being domain users.

Personally? I'd modify the approach and remap (using the UPDATE command from the article) all users except for a single user who is also a RootAdmin in Qlik Sense. That way you can authenticate and debug with a known good local user. But that's entirely up to you.

Re: Convert QS local users to AD Users

Gestion-PSD — Tue, 22 Oct 2019 11:00:02 GMT

Thanks, Levi for that quik reply.

We're going to use option B and, maybe (it depends on my boss), we use your approach of remap all but one users.

Regards,

Lujan Torres.

Re: Convert QS local users to AD Users

BTIZAG_OA — Tue, 22 Oct 2019 12:57:55 GMT

Hello Gestion,

In my opinion option B is the right order. If you activate AD first your local users will be marked as Inactive and probably you have doubled users.

Its ok to authenticate users without AD sync.

But dont forget to change hostname/create new certs. before all this steps which is needed to run Qlik sense with new hostname.

Re: Convert QS local users to AD Users

Gestion-PSD — Tue, 22 Oct 2019 15:21:04 GMT

Hi!

It's done. We hadn't had to change hostname/certs. All links to QS hub/qmc, etc runs OK without doing this.

Thanks both of you.