topic Re: Sync Active Directory users from multiple domains with Advanced LDAP in Management & Governance

Sync Active Directory users from multiple domains with Advanced LDAP

jchoucq — Thu, 21 Oct 2021 07:47:13 GMT

Hi everybody,

does anybody try to sync active directory users from an AD Global Catalog to gets users from multiple domains ?

There is a great article https://community.qlik.com/t5/Knowledge/Sync-Active-Directory-users-from-multiple-domains-with-Advanced/ta-p/1799273, but for the moment, in my customer's environment, we can't make it work.

Even with a ldap filter, that must give us many few users we can see in the log file, the error below. It is mentionned the the size limit was exceeded, but what kind of size is it ?

Exception when fetching data from 'MyDomain' of type Repository.UserDirectoryConnectors.LDAP.AdvancedLDAP The size limit was exceeded↵↓Couldn't retrieve users from directory: 'MyDomain' of type Repository.UserDirectoryConnectors.LDAP.AdvancedLDAP

However, when using ldapadmin tool with the same filter and account, it seems working, i mean the size limit error seems not be thrown by windows ad.

Doest anyody succeed in create on specific advanced ldap connector to get users from multiple domains ?

Have a good day.

Joh

Re: Sync Active Directory users from multiple domains with Advanced LDAP

Alexis_Touet — Wed, 03 Nov 2021 17:14:40 GMT

Hi @jchoucq

Looking at the error, it looks like it refers to the page size of search.

I can see this setting on the advanced properties, could you please try a value (for example 2000) and try to increase it by doubling it.

Best regards,

Re: Sync Active Directory users from multiple domains with Advanced LDAP

jchoucq — Thu, 04 Nov 2021 18:20:02 GMT

Hi @Alexis_Touet thank you for your answer, in fact the advanced ldap connector has a strange behavior, even if you add an ldap filter, it recovers all the groups of the user, for the whole directory regardless the initial filter. In my case, it represents a huge number of objects what causes the error !

changing the page size parameter does not have an impact, I don’t know why it has been put as a solution.

best regards

johann

Re: Sync Active Directory users from multiple domains with Advanced LDAP

Alexis_Touet — Thu, 04 Nov 2021 18:32:24 GMT

Hi @jchoucq

Have you checked if the same LDAP filter works on an external tool such as LDAPAdmin https://community.qlik.com/t5/Knowledge/LDAP-Server-Testing-using-LDAP-Admin-tool/ta-p/1710642 ? And also confirm that the attributes of your LDAP are similar to what is set on the Directory entry attributes? (with LDAP admin you can see the attributes of your environment by clicking on a user or group )

Some articles that can also help:

https://community.qlik.com/t5/Knowledge/Qlik-Sense-Example-of-a-LDAP-filter-to-sync-users-in-a-group/ta-p/1713735

https://community.qlik.com/t5/Knowledge/Qlik-Sense-on-Windows-Configuring-and-testing-LDAP-filters-for/ta-p/1713947

Best regards,

Re: Sync Active Directory users from multiple domains with Advanced LDAP

jchoucq — Mon, 08 Nov 2021 14:57:10 GMT

thanks for your answer @Alexis_Touet

with the same ldap filter in LDAP Admin, we get 148 objects (users + groups), and we get an error with qlik sense, due to the fact that Qlik Sense add something in the filter that try to give all groups, regardless the initial filter.

Look what we find in the logs : Initiating search on base DN dc=MyDmain,dc=ad with filter (objectClass=group)

Johann