topic Re: SAML attribute in section access in Management & Governance

SAML attribute in section access

fjuken — Wed, 29 Jan 2025 16:38:32 GMT

Hi,

Configured Integration from Qlik Sense onPrem towards Azure AD.
Access to QMC and Hub works fine using security rules , but when I access a app i get 'access denied'.
Based on documentation it should be possible to reUse the SAML 'group' attribute in access script, right?

Please advice!

Re: SAML attribute in section access

Eugene_Sleator — Tue, 25 Oct 2022 13:52:58 GMT

HI @fjuken in order for this to work you need to include the Group attribute in the Virtual Proxy. Please refer to these Qlik articles for an explanation;

Qlik Sense: Section Access not working with SAML attributes

User-Environment-What-Session-Attributes-in-Qlik-Sense

Section-Access-User-Attributes

Hope this helps

Re: SAML attribute in section access

fjuken — Thu, 29 Sep 2022 13:37:35 GMT

Thanks for reply, @Eugene_Sleator !

We've configured following on the virtual Proxy (we're sending group objects from AzureAD as attribute 'group')

Using this proxy for access to QMC and HUB works as expected, but when we try to access apps we get 'Access Denied'

We tried different combinations of adding this to the access script, as you see an example of in the post, both linking to group attribute and the username of the SAML authenticated user ++ but we're not able to get access to the app using SAML authentication..

Br,

Håvard Fjukstad.

Re: SAML attribute in section access

Eugene_Sleator — Tue, 25 Oct 2022 13:52:25 GMT

Hi @fjuken can you try with the "SAML attribute" set to groups NOT group

Re: SAML attribute in section access

fjuken — Fri, 28 Oct 2022 15:43:46 GMT

Hi @Eugene_Sleator

Seems like our issue is related to casing.
After adding this to the access script we managed to login and access app.

_sa:
LOAD Upper(ACCESS) AS ACCESS,
Upper(USERID) AS USERID,
Upper(GROUP) AS GROUP,
Upper(%SAKEY) AS %SAKEY
Inline [

Br,
Håvard Fjukstad.