https://community.qlik.com/t5/Official-Support-Articles/Users-belonging-to-a-group-from-another-domain-cannot-access/ta-p/1715206 <P>Users belonging to domain A and being a member of a group created in domain B cannot access resources with the following rule:</P> <P><BR /><FONT face="courier new,courier">((user.group="group1"))</FONT></P> <P>Qlik Sense saves group name in a different format if they are from a different domain than the user.</P> <P class="qlik-migrated-tkb-headings">&nbsp;</P> <H4>Resolution:</H4> <P><BR />Users that are from a different domain than the group they belong to will have the group name with the following format in Qlik Sense:</P> <P><BR /><FONT face="courier new,courier">CN=group1,OU=Users,DC=us,DC=domain,DC=local</FONT><BR /><BR />This can be checked by going in the "Users" section in the QMC and clicking on the info button next to the user name.</P> <P><BR /><IMG src="https://qlik.my.salesforce.com/servlet/servlet.ImageServer?id=015D0000003s6gb&amp;oid=00D20000000IGPX&amp;lastMod=1490964815000" border="0" alt="User-added image" width="500" /><BR /><BR />Therefore the security should use the following rule so that all users (from the same domain and from different domains) are included:</P> <P><BR /><FONT face="courier new,courier">((user.group="group1" or user.group="CN=group1,OU=Users,DC=us,DC=domain,DC=local"))</FONT></P> Mon, 24 Aug 2020 11:04:58 GMT Damien_V 2020-08-24T11:04:58Z https://community.qlik.com/t5/Official-Support-Articles/Users-belonging-to-a-group-from-another-domain-cannot-access/ta-p/1715206 <P>Users belonging to domain A and being a member of a group created in domain B cannot access resources with the following rule:</P> <P><BR /><FONT face="courier new,courier">((user.group="group1"))</FONT></P> <P>Qlik Sense saves group name in a different format if they are from a different domain than the user.</P> <P class="qlik-migrated-tkb-headings">&nbsp;</P> <H4>Resolution:</H4> <P><BR />Users that are from a different domain than the group they belong to will have the group name with the following format in Qlik Sense:</P> <P><BR /><FONT face="courier new,courier">CN=group1,OU=Users,DC=us,DC=domain,DC=local</FONT><BR /><BR />This can be checked by going in the "Users" section in the QMC and clicking on the info button next to the user name.</P> <P><BR /><IMG src="https://qlik.my.salesforce.com/servlet/servlet.ImageServer?id=015D0000003s6gb&amp;oid=00D20000000IGPX&amp;lastMod=1490964815000" border="0" alt="User-added image" width="500" /><BR /><BR />Therefore the security should use the following rule so that all users (from the same domain and from different domains) are included:</P> <P><BR /><FONT face="courier new,courier">((user.group="group1" or user.group="CN=group1,OU=Users,DC=us,DC=domain,DC=local"))</FONT></P> Mon, 24 Aug 2020 11:04:58 GMT https://community.qlik.com/t5/Official-Support-Articles/Users-belonging-to-a-group-from-another-domain-cannot-access/ta-p/1715206 Damien_V 2020-08-24T11:04:58Z