Convert QS local users to AD Users

[Gestion-PSD]

Hi!

We'he a QS Enterprise installation with local users and we're going to insert this server on a domain with an Active Directory.

This AD had already the same QS users that the local server. We'd read about how to deal with this situation (https://qliksupport.force.com/articles/000050442?_ga=2.101025537.1048288763.1571653526-1802325108.15...) but we aren't sure about the right steps secuence:

Option A:

1. Insert server in Domain an AD
2. Activate AD synchroization
3. Follow the steps on article cited above

or Option B:

1. Insert server in Domain an AD
2. Follow the steps on article cited above
3. Activate AD sync.

I think in Option A it's possible to have duplicated users with same userID and domain, and We don't know how QS will response.

Otherwise, in Option B it's possible than users can't authenticate in AD because Qlik isn't sync. with AD.

Coudl you bring some ligth about this?

Thanks!

[Levi_Turner · Accepted solution]

Option B is cleaner. Join the domain, remap the users at the PostgreSQL layer, then the users will seamlessly switch over to being domain users.

Personally? I'd modify the approach and remap (using the UPDATE command from the article) all users except for a single user who is also a RootAdmin in Qlik Sense. That way you can authenticate and debug with a known good local user. But that's entirely up to you.

[Gestion-PSD]

Thanks, Levi for that quik reply.

We're going to use option B and, maybe (it depends on my boss), we use your approach of remap all but one users.

Regards,

Lujan Torres.

[BTIZAG_OA · Accepted solution]

Hello Gestion,

In my opinion option B is the right order. If you activate AD first your local users will be marked as Inactive and probably you have doubled users.

Its ok to authenticate users without AD sync.

But dont forget to change hostname/create new certs. before all this steps which is needed to run Qlik sense with new hostname.

[Gestion-PSD]

Hi!

It's done. We hadn't had to change hostname/certs. All links to QS hub/qmc, etc runs OK without doing this.

Thanks both of you.