article Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows in Official Support Articles

Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

Bastien_Laugiero — Thu, 02 Jun 2022 10:27:33 GMT

Historically, in order to load users member from multiple Active Directory Domains was not possible with a single User Directory Connector. It was required to create one User Directory Connector per domain making the Active Directory administration more complex for the IT Team.

Starting from Qlik Sense September 2020, it is now possible to achieve this with Advanced LDAP.

Starting on Qlik Sense February 2021, multiple domain names are synchronized instead of allowing for duplicate users with the real domain name to populate when they login. (Look for QB-2187)

Environment

, September 2020 and higher

Click Here Video Transcript

Requirement(s):

Make sure there full trust between the different Active Directory Domains in the same forest.

Steps:

In one of the domain, create an Active Directory Universal Security group and add the list of users from multiple domains you want to sync into Qlik Sense.
Then go to QMC -> User Directory Connector and create an Advanced LDAP Connection
Provide a name and user directory name
Uncheck the box “Sync user data for existing users” so that we can import new users into Qlik Sense
In the host section, you will need to point to the Global Catalog port which is 3268 for LDAP and 3269 for LDAPS by default so that the sync can capture user through the entire forest.
Add a username and password to connect to the Global Catalog.
The base DN here is important as it needs to refer to the forest name in order to navigate through the child domains.
You can then add an LDAP filter to load the user member of the group you created earlier. Make sure that the rootAdmin accounts used to manage Qlik Sense are not excluded by the new LDAP filter. More information under How to avoid the RootAdmin(s) from becoming inactive
And finally you will need to change in the Directory entry attributes the User identifier from “inetOrgPerson” to “person”. This is specific to Active Directory.

It is now time to run the synchronization and check that your users are imported.

The information in this article is provided as-is and to be used at own discretion. Depending on tool(s) used, customization(s), and/or other factors ongoing support on the solution above may not be provided by Qlik Support.

Re: Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

jchoucq — Wed, 20 Oct 2021 09:16:59 GMT

Hello @Bastien_Laugiero

thank you very much for this great article.

I'm trying to use this advanced Ldap connector in my customer environement, and i always get the same error in the log file :

Exception when fetching data from 'MyDomain' of type Repository.UserDirectoryConnectors.LDAP.AdvancedLDAP The size limit was exceeded↵↓Couldn't retrieve users from directory: 'MyDomain' of type Repository.UserDirectoryConnectors.LDAP.AdvancedLDAP

even with an ldap filter that send very few users, it is the same. What size are we talking about here ?

Have a goo dat.

Johann

Re: Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

Sonja_Bauernfeind — Wed, 20 Oct 2021 11:54:10 GMT

Hello @jchoucq

This is dependent on the source.

On the Qlik end you can set advanced UDC settings, see Advanced UDC Settings for details.

Re: Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

jchoucq — Wed, 20 Oct 2021 12:20:29 GMT

Hi @Sonja_Bauernfeind

thanks for your answer. Yes, we tried, among other things, to change Page size (2000, or 4000 ...)

We are connecting to an active directory global catalog, and the experts with me do not understand either this limit size error message 😞

Re: Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

Sonja_Bauernfeind — Wed, 20 Oct 2021 12:41:27 GMT

~~Let me see if I can get an SME to give this a look~~, This is what we have on that issue for you: How to configire Maxpagesize in LDAP server to avoid a "The size limit was exceeded" or a "QVX_UNEXPECTED_END_OF_DATA" error message - but if that does not help, I'd recommend posting the question over in the relevant forums where you can make use of our active community and our agents. Think this one is the right one: Deployment and Management.

Re: Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

jchoucq — Wed, 20 Oct 2021 12:47:55 GMT

Thanks a lot @Sonja_Bauernfeind

I saw this article yesterday, i'm going to insist on my client to take a closer look at it.

For information i already created a message on the partner teams. Do you think it will be better to post the question in the forum too ?

Thanks again.

Johann

Re: Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

Sonja_Bauernfeind — Wed, 20 Oct 2021 13:55:36 GMT

I think the forums are always a great idea! You'll get the input from a lot more people there.

Re: Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

jchoucq — Thu, 21 Oct 2021 07:49:53 GMT

just did it 🙂

https://community.qlik.com/t5/Deployment-Management/Sync-Active-Directory-users-from-multiple-domains-with-Advanced/m-p/1849899

thanks a lot @Sonja_Bauernfeind

Re: Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

jchoucq — Fri, 22 Oct 2021 09:54:04 GMT

For information, i noticed that the Ldap Filter you add in the "Search Ldap Filter" property is not exactly what will be executed by Qlik Sense. Let's assume we write "MyLdapFilter", here is what we can find in debug log file :

(|(&(objectClass=person)(MyLdapFilter))(objectClass=group))

this is a problem in my case, because this filter gets backs too many groups i never asked for !

Surprising, this is not the same behaviour with Active Directory connector which change your Ldap filter in

(&(objectCategory=person)(MyLdapFilter))

@Sonja_Bauernfeind @Bastien_Laugiero have you got an idea of what can be done to try to fix that ?

Thanks a lot.

johann

Re: Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

Filippo_Nicolussi_P — Wed, 27 Oct 2021 13:14:54 GMT

The "|" and "(objectClass=group)" is added by design when you use Active Directory to get all the Group Attribute.

In recent version there is an option called "Use optimized query" to change the mode to retrive the Groups in case you use instead Generic LDAP or Advanced LDAP UDC Configuration.

If with the Generic/Advanced LDAP configuration and the option "Use Optimized query" you still don't get all the attribute for the page size issue an alternate SSO / UDC could be evaluated/studied with our Professional Services.

Re: Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

jchoucq — Wed, 27 Oct 2021 15:25:45 GMT

hi @Filippo_Nicolussi_P , thank you very much for your answer.

With the propery "optimized query" we go further in the process, but at the end we still get an error.

indeed, ti seems that they are many steps, first, it adds users respecting the filter, that is correct. But after, for the groups, it seems looping to get all the groups from the groups it detected in the precedent ldap request, regardless the initial filter.

In our case, this is why it goes over the page size ... the customer ldap experts do not understand why, as what is done for users, the groups it tries to get back do not respect the initial LDAP Filter.

Thanks again

Johann

Re: Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

Filippo_Nicolussi_P — Wed, 27 Oct 2021 18:36:32 GMT

Hi Johann

Just a little follow-up on a Active Directory perspective; based on the official site DC returns only 5000 values in LDAP response - Windows Server | Microsoft Docs there are some hardcoded limitations introduced:

"Internal LDAP limitations have been introduced in Windows Server 2008 R2 and Windows Server 2008 to prevent overloading the domain controller. These limits overwrite the LDAP policy setting when the policy value should be higher"

with hardcoded MaxPageSize=20000 and MaxValRange=5000 .

Many thanks.

Filippo

Re: Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

jchoucq — Tue, 02 Nov 2021 13:12:58 GMT

Thank you @Filippo_Nicolussi_P

For a specific need my customer changed the MaxPageSize in the past to 30000, but even with this high threshold, this is not enough in our context.

With the "use optimized query", in the debug log, in can find than the last ldap filter executed by qlik sense is (objectClass=group) what seems far too broad and not in line with what we asked for.

Johann

Re: Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

rakeshshah — Fri, 18 Nov 2022 00:10:03 GMT

Thank you for the article and details. What I would like to know is once this has been setup will the users get a SSO experience or be prompted to enter username and password depending on the domains?

Alternatively what I'm trying to do is have an SSO experience for two domains - is this possible? It is currently SSO for the domain the Server is installed with, but not for Domain B

Thanks

Rakesh

Re: Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

Sonja_Bauernfeind — Wed, 23 Nov 2022 08:43:08 GMT

Hello @rakeshshah

Authentication in this case is still being carried out by Windows and if Windows requires a prompt, a prompt will be displayed. You would likely need to build an independent single sign on system in front of both domains to achieve this.

Please post about your requirements in our forums: Deployment and Management

All the best,
Sonja

article Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows in Official Support Articles

Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

Environment

Requirement(s):

Steps:

Related Content

Re: Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

Re: Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

Re: Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

Re: Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

Re: Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

Re: Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

Re: Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

Re: Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

Re: Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

Re: Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

Re: Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

Re: Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

Re: Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows

Re: Sync Active Directory users from multiple domains with Advanced LDAP - Qlik Sense Enterprise on Windows