topic Re: Session Access & Data Reduction with LDAP users in Management & Governance

Session Access & Data Reduction with LDAP users

Ajith_Raja_QlikSense — Wed, 29 Jan 2025 16:21:29 GMT

Hi,

I have imported my LDAP users which has more than 2000 users. I want to have Data reduction for each user based on location.

By Fixing the users static as shown below, In this way I am able to handle the Data Reduction for users based on Branch.

But how to get the LDAP users list ,instead of INLINE load?

Since I have more users it is hard to fix all users in INLINE load, kindly help me on this.

Example:

Section Access;
Load * INLINE [
ACCESS, USERID, BRANCH
ADMIN, 01235 , CHENNAI
ADMIN, 66286, HYDERABAD
USER 336277, HYDERABAD
];
Section Application;
Branch:
LOAD

BRANCH,

......

FROM .....;

Re: Session Access & Data Reduction with LDAP users

TcnCunha_M — Fri, 19 Jul 2024 13:03:52 GMT

Connect to Ldap and extract the user, store as Qvd and use it.

Re: Session Access & Data Reduction with LDAP users

Ajith_Raja_QlikSense — Mon, 22 Jul 2024 04:52:41 GMT

Hi,

Thanks for the reply, I have imported the LDAP users using the QMC User Active directory connections.

Kindly provide any sample Connection string format & How to store LDAP Users as QVD.

Thank You..

Re: Session Access & Data Reduction with LDAP users

TcnCunha_M — Mon, 22 Jul 2024 08:19:28 GMT

there some sample on the community like:
Active Directory: Extract Users and Groups - Qlik Community - 1479167

to not load all of your Active directory, try to get only the user has licenses on Qlik Sense by rest api
Qlik Sense License Management through API - Qlik Community - 116033

Re: Session Access & Data Reduction with LDAP users

Levi_Turner — Fri, 26 Jul 2024 19:15:01 GMT

Here's an example script on how to leverage the OLE DB Provider for Microsoft Directory Services to load from AD:

AccountStatusMapping:
MAPPING LOAD * INLINE [
userAccountControl,Type
512,Active
514,Disabled
544,Active
546,Disabled
66048,Active
66050,Disabled
66080,Active
66082,Disabled
6291970,Disabled
1049090,Disabled
524802,Disabled
4784640,Active
4194816,Active
524800,Active
524832,Active
1049088,Active
];

FOR v=ORD('a') TO ORD('z')
 LET q=CHR($(v));
 LIB CONNECT TO '<my data connection name>';
 ActiveDirectory:
 LOAD 
 *,
            ApplyMap('AccountStatusMapping',Num(userAccountControl),'Undefined') AS [Status];
 SQL SELECT
 sAMAccountName,
 displayName,
 userAccountControl
 FROM 'LDAP://<domain>.com'
 WHERE objectCategory = 'person' AND displayName ='$(q)*';
NEXT ;

Some notes:

We loop over A-Z because Qlik will not load more users than the page size on the LDAP using this driver (in Windows Active Directory this will be the MaxPageSize setting ref: https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/view-set-ldap-policy-using-ntdsutil ).
A more sophisticated LDAP query (consult your LDAP experts on this) may avoid this limit by focusing your efforts on only active users (not ones which have been disabled).
The fields, especially the userAccountControl field, are Windows Active Directory specific, your LDAP may use different fields.
Leverage external tools like Softerra's LDAP Browser (or consult your LDAP experts) on the field names. The data preview will not work.