topic Re: Configure User Directory to Azure LDAP in Management & Governance

Configure User Directory to Azure LDAP

azimuthbrett — Thu, 22 Sep 2016 15:27:05 GMT

We've set up Qlik Sense on a server, and are experimenting with trying to configure it to connect to Azure Active Directory. We followed all of the instructions in the Azure article "Configure Secure LDAP for an Azure AD Domain Services Managed Domain" (Configure Secure LDAP (LDAPS) in Azure AD Domain Services | Microsoft Azure). We've got an AD setup on Azure, and we created a wildcard certificate with a Certificate Authority (GoDaddy). So with a domain for the company of 'example.com', the wildcard cert is '*.example.com'. We exported this certificate from the Qlik Sense server per the instructions in the Azure article, loaded it into the Domain Services configuration panel on Azure, and received an IP address for LDAPS.

We then configured DNS A record so that the subdomain ('ldap.example.com') points to this IP address. When we run a scan on the IP and the DNS alias at MXtoolbox.com we get a valid scan showing the IP address is there, with only port 443 open (https).

Now over to Sense: in the QMC -> User Directory Connector, we can't manage to figure out how to connect to the LDAP server. Do we need to set up a virtual proxy to bind the certificate?

Typical log entries:

20160922T064554.973-0700

INFO

demoqlik

UserManagement.Repository.Repository.Users.Factories.UserDirectoryFactory

107

09c1532a-ef60-429b-a182-e9c6cc279af1

NT AUTHORITY\SYSTEM

Looking up RootDSE: LDAP://ldap.example.com:443/RootDSE

09c1532a-ef60-429b-a182-e9c6cc279af1

20160922T064555.038-0700

ERROR

demoqlik

UserManagement.Repository.Repository.Users.Factories.UserDirectoryFactory

107

c7e246ce-b5a1-411e-a895-6673bda08f91

NT AUTHORITY\SYSTEM

Fetching directoryentry LDAP://ldap.example.com:443/RootDSE failed: The directory service is unavailable.↵↓

c7e246ce-b5a1-411e-a895-6673bda08f91

20160922T064555.038-0700

ERROR

demoqlik

UserManagement.Repository.Repository.Users.Factories.UserDirectoryFactory

107

ac0c1648-b9d9-4174-8020-8cc654beaf1d

NT AUTHORITY\SYSTEM

Exception while initializing ldap://ldap.example.com:443: Setting up connection to LDAP root node failed. Check log file.

ac0c1648-b9d9-4174-8020-8cc654beaf1d

20160922T064555.038-0700

WARN

demoqlik

UserManagement.Repository.Repository.Users.Factories.UserDirectoryFactory

107

414351f5-62d9-4f41-bd8c-bffd56948887

NT AUTHORITY\SYSTEM

Setup of ActiveDirectory UDC not successful: Setting up connection to LDAP root node failed. Check log file.

414351f5-62d9-4f41-bd8c-bffd56948887

20160922T064555.038-0700

WARN

demoqlik

UserManagement.Repository.Repository.Users.Factories.UserDirectoryFactory

ffc751e2-16d6-4fb0-bd5d-dbf01404171c

NT AUTHORITY\SYSTEM

Setting up UDC of type Repository.UserDirectoryConnectors.LDAP.ActiveDirectory unsuccessful

Setting up connection to LDAP root node failed. Check log file.

↵↓Server stack trace: ↵↓ at Repository.UserDirectoryConnectors.LDAP.LDAPRoot.FindEntry(String path, GenericLDAP ldap)↵↓ at Repository.UserDirectoryConnectors.LDAP.ActiveDirectory.FindRoot()↵↓ at Repository.UserDirectoryConnectors.LDAP.GenericLDAP.Setup(Logger logger)↵↓ at System.Runtime.Remoting.Messaging.StackBuilderSink._PrivateProcessMessage(IntPtr md, Object[] args, Object server, Object[]& outArgs)↵↓ at System.Runtime.Remoting.Messaging.StackBuilderSink.AsyncProcessMessage(IMessage msg, IMessageSink replySink)↵↓↵↓Exception rethrown at [0]: ↵↓ at System.Runtime.Remoting.Proxies.RealProxy.EndInvokeHelper(Message reqMsg, Boolean bProxyCase)↵↓ at System.Func`1.EndInvoke(IAsyncResult result)↵↓ at Repository.Users.SafeUserDirectoryConnector.CallWithTimeout(Func`1 func, TimeSpan timeout)↵↓ at Repository.Users.SafeUserDirectoryConnector.Setup(Logger logger)↵↓ at Repository.Users.Factories.UserDirectoryFactory.TrySetupUserDirectory(UserDirectory userDirectory)

ffc751e2-16d6-4fb0-bd5d-dbf01404171c

Confused, would appreciate any assistance or ideas. Thank you!

Re: Configure User Directory to Azure LDAP

Anonymous — Thu, 22 Sep 2016 16:21:24 GMT

Hello Brett, I'm adding one of our experts ext_kea‌ Kate Healy to this thread so she can assist.

Best, Sara

Re: Configure User Directory to Azure LDAP

joan_marty — Fri, 23 Sep 2016 08:32:51 GMT

Hi, I'm also running this kind of activity at the moment, trying to integrate AZURE AD with Qlik Sense to get SSO and other things linked to this.

I'm still in progress but I can already give you this link which shows how to delcare Qlik Sense Server in Azure

https://azure.microsoft.comen-usdocumentationarticlesactive-directory-saas-qliksense-enterprise-tutorial

Maybe it can help you a bit

Re: Configure User Directory to Azure LDAP

azimuthbrett — Wed, 08 Feb 2017 13:19:21 GMT

Thanks Joan. Looks like the URL you posted has some missing backslashes...I was getting an error page. For anyone else that attempts, this one should work:

https://docs.microsoft.com/en-us/azure/active-directory/active-directory-saas-qliksense-enterprise-tutorial‌

If it doesn't I found the doc by going to azure.microsoft.com and searching "Qlik Sense".

It's been several months since we attempted setting this up so I can't recall all of the details. I can say that we went through every step in that same tutorial. The problem (as I recall) is that it sets you up to access Sense from the Azure portal - i.e. users are logged into Azure and have a Sense app they can click on to get to the dashboards. Not what we wanted.

What we wanted was to enable SSO. So a user with valid AD credentials managed via a cloud-based AD setup on Azure would provide their company credentials when logging into sense (e.g. on a company domain such as https://dashboards.example.com). We wanted Sense to be able to authenticate the user directly by reference to the remote AD. We were never able to figure it out.

Re: Configure User Directory to Azure LDAP

joan_marty — Wed, 08 Feb 2017 15:08:55 GMT

Tutorial: Azure Active Directory integration with Qlik Sense Enterprise | Microsoft Docs

It shall be better with this one. Slash were removed from the previous link I provided I don't know why

Re: Configure User Directory to Azure LDAP

joan_marty — Wed, 08 Feb 2017 16:58:57 GMT

Effectively in such case wanting to propagate SSO, the only option we found internally is to synchronize Azure AD with a local AD in the domain.

We did not found yet any other possibility to do differently.

Joan Marty

Le 8 févr. 2017 à 17:10, Brett Odom <qcwebmaster@qlikview.com<mailto:qcwebmaster@qlikview.com>> a écrit :

Re: Configure User Directory to Azure LDAP

thomaslg_wq — Thu, 26 Apr 2018 09:09:31 GMT

Finally :

if anyone wants to create an Azure AD UDC : here attached is the "Generic LDAP UDC configuration".

So, you just have to change the User-Directory-Attribute "User identification" to "Person" and that's it