We've set up Qlik Sense on a server, and are experimenting with trying to configure it to connect to Azure Active Directory. We followed all of the instructions in the Azure article "Configure Secure LDAP for an Azure AD Domain Services Managed Domain" (Configure Secure LDAP (LDAPS) in Azure AD Domain Services | Microsoft Azure). We've got an AD setup on Azure, and we created a wildcard certificate with a Certificate Authority (GoDaddy). So with a domain for the company of 'example.com', the wildcard cert is '*.example.com'. We exported this certificate from the Qlik Sense server per the instructions in the Azure article, loaded it into the Domain Services configuration panel on Azure, and received an IP address for LDAPS.
We then configured DNS A record so that the subdomain ('ldap.example.com') points to this IP address. When we run a scan on the IP and the DNS alias at MXtoolbox.com we get a valid scan showing the IP address is there, with only port 443 open (https).
Now over to Sense: in the QMC -> User Directory Connector, we can't manage to figure out how to connect to the LDAP server. Do we need to set up a virtual proxy to bind the certificate?
Typical log entries:
| 41 | 20160922T064554.973-0700 | INFO | demoqlik | UserManagement.Repository.Repository.Users.Factories.UserDirectoryFactory | 107 | 09c1532a-ef60-429b-a182-e9c6cc279af1 | NT AUTHORITY\SYSTEM | Looking up RootDSE: LDAP://ldap.example.com:443/RootDSE | | | | 09c1532a-ef60-429b-a182-e9c6cc279af1 |
| 42 | 20160922T064555.038-0700 | ERROR | demoqlik | UserManagement.Repository.Repository.Users.Factories.UserDirectoryFactory | 107 | c7e246ce-b5a1-411e-a895-6673bda08f91 | NT AUTHORITY\SYSTEM | Fetching directoryentry LDAP://ldap.example.com:443/RootDSE failed: The directory service is unavailable.↵↓ | | | | c7e246ce-b5a1-411e-a895-6673bda08f91 |
| 43 | 20160922T064555.038-0700 | ERROR | demoqlik | UserManagement.Repository.Repository.Users.Factories.UserDirectoryFactory | 107 | ac0c1648-b9d9-4174-8020-8cc654beaf1d | NT AUTHORITY\SYSTEM | Exception while initializing ldap://ldap.example.com:443: Setting up connection to LDAP root node failed. Check log file. | | | | ac0c1648-b9d9-4174-8020-8cc654beaf1d |
| 44 | 20160922T064555.038-0700 | WARN | demoqlik | UserManagement.Repository.Repository.Users.Factories.UserDirectoryFactory | 107 | 414351f5-62d9-4f41-bd8c-bffd56948887 | NT AUTHORITY\SYSTEM | Setup of ActiveDirectory UDC not successful: Setting up connection to LDAP root node failed. Check log file. | | | | 414351f5-62d9-4f41-bd8c-bffd56948887 |
| 45 | 20160922T064555.038-0700 | WARN | demoqlik | UserManagement.Repository.Repository.Users.Factories.UserDirectoryFactory | 33 | ffc751e2-16d6-4fb0-bd5d-dbf01404171c | NT AUTHORITY\SYSTEM | Setting up UDC of type Repository.UserDirectoryConnectors.LDAP.ActiveDirectory unsuccessful | Setting up connection to LDAP root node failed. Check log file. | ↵↓Server stack trace: ↵↓ at Repository.UserDirectoryConnectors.LDAP.LDAPRoot.FindEntry(String path, GenericLDAP ldap)↵↓ at Repository.UserDirectoryConnectors.LDAP.ActiveDirectory.FindRoot()↵↓ at Repository.UserDirectoryConnectors.LDAP.GenericLDAP.Setup(Logger logger)↵↓ at System.Runtime.Remoting.Messaging.StackBuilderSink._PrivateProcessMessage(IntPtr md, Object[] args, Object server, Object[]& outArgs)↵↓ at System.Runtime.Remoting.Messaging.StackBuilderSink.AsyncProcessMessage(IMessage msg, IMessageSink replySink)↵↓↵↓Exception rethrown at [0]: ↵↓ at System.Runtime.Remoting.Proxies.RealProxy.EndInvokeHelper(Message reqMsg, Boolean bProxyCase)↵↓ at System.Func`1.EndInvoke(IAsyncResult result)↵↓ at Repository.Users.SafeUserDirectoryConnector.CallWithTimeout(Func`1 func, TimeSpan timeout)↵↓ at Repository.Users.SafeUserDirectoryConnector.Setup(Logger logger)↵↓ at Repository.Users.Factories.UserDirectoryFactory.TrySetupUserDirectory(UserDirectory userDirectory) | | ffc751e2-16d6-4fb0-bd5d-dbf01404171c |
Confused, would appreciate any assistance or ideas. Thank you!
