Whoops, missed this. Here's an approach (it doesn't handle the token model but for you should be no issue):
#--------------------------------------------------------------------------------------------------------------------------------
#
# Script Name: qlik_sense_purge_removed_externally_users.ps1
# Description: Remove the assigned licenses of users who are marked as removed externally
# Dependency: Qlik-Cli (https://github.com/ahaydon/Qlik-Cli)
#
# Version Date Author Change Notes
# 0.1 2019-08-23 Levi Turner Initial version
#--------------------------------------------------------------------------------------------------------------------------------
# Helper function for recording timestamps in the logging
function Get-TimeStamp {
return "[{0:MM/dd/yy} {0:HH:mm:ss}]" -f (Get-Date)
}
# More verbose Get-QlikUser function
function Get-QlikUser {
[CmdletBinding()]
param (
[parameter(Position=0,ValueFromPipelinebyPropertyName=$true)]
[string]$id,
[string]$filter,
[switch]$full,
[switch]$raw
)
PROCESS {
$path = "/qrs/user"
If( $id ) { $path += "/$id" }
If( $full ) { $path += "/full" }
If( $raw ) { $rawOutput = $true }
$result = Invoke-QlikGet $path $filter
if( $raw -Or $full ) {
return $result
} else {
$properties = @('name','userDirectory','userId','id','removedExternally')
#if( $full ) { $properties += @('roles','inactive','blacklisted','removedExternally') }
return $result | Select-Object -Property $properties
}
}
}
# Helper function for removing Analyzer licenses; not found in Qlik-Cli when script was being built
function Remove-QlikAnalyzerAccessType {
[CmdletBinding()]
param (
[parameter(Position=0,ValueFromPipelinebyPropertyName=$true)]
[string]$id
)
PROCESS {
return Invoke-QlikDelete -path "/qrs/license/analyzeraccesstype/$id"
}
}
function Remove-QlikProfessionalAccessType {
[CmdletBinding()]
param (
[parameter(Position=0,ValueFromPipelinebyPropertyName=$true)]
[string]$id
)
PROCESS {
return Invoke-QlikDelete -path "/qrs/license/professionalaccesstype/$id"
}
}
# Logging
Set-Location $PSScriptRoot
$logdir = $PSScriptRoot + '\logs'
$logfile = $logdir + "\" + (Get-Date -Format yyyyMMdd) + ".log"
if (!(Test-Path $logdir)){
New-Item -path $logdir -type directory | Out-Null
}
# Connect to Qlik Sense
Connect-Qlik
# Clearing out Variables
$tokenusers = ''
# Get the version of QRS to figure out license model
$version = Invoke-QlikGet -path /qrs/about
Write-Output "$(Get-TimeStamp) : Build version: $($version.buildversion)" | Out-File -FilePath $logfile -Append
# If the version of QRS is less than April, tokens are being used, otherwise will need to check
if ($($version.buildVersion) -lt '20.4.2.0') {
Set-Variable -Name "licensemodel" -Value "token"
} else {
Set-Variable -Name "licensemodel" -Value "variable"
}
# Get list of users assigned named licenses
if ($($licensemodel) -eq 'variable') {
# if 2018-04 or higher then get the overview to later determine which license model is in effect
$LicenseOverview = Invoke-QlikGet -path /qrs/License/accesstypeoverview
Write-Output "$(Get-TimeStamp) : $($LicenseOverview)" | Out-File -FilePath $logfile -Append
if ($($LicenseOverview).totalTokens -eq '0') {
# If the totalTokens value in the LicenseOverview response zero, then get Professional User allocations
Set-Variable -Name "licensemodel" -Value "pa" -Force
$professionalusers = Invoke-QlikGet -path '/qrs/License/ProfessionalAccessType/full'
Write-Output "$(Get-TimeStamp) : $($professionalusers.count) professional licenses" | Out-File -FilePath $logfile -Append
$analyzerusers = Invoke-QlikGet -path '/qrs/License/AnalyzerAccessType/full'
Write-Output "$(Get-TimeStamp) : $($analyzerusers.count) analyzer licenses" | Out-File -FilePath $logfile -Append
} else {
# If the totalTokens value in the LicenseOverview response is non-zero then the token model is in use, get user access pass allocations
Set-Variable -Name "licensemodel" -Value "token" -Force
$tokenusers = Invoke-QlikGet -path '/qrs/License/UserAccessType/full'
Write-Output "$(Get-TimeStamp) : $($tokenusers.count) licenses" | Out-File -FilePath $logfile -Append
}
} else {
# if 2018-02 or earlier, then use token model and get user access pass allocations
Set-Variable -Name "licensemodel" -Value "token" -Force
$tokenusers = Invoke-QlikGet -path '/qrs/License/UserAccessType/full'
Write-Output "$(Get-TimeStamp) : $($tokenusers.count) licenses" | Out-File -FilePath $logfile -Append
}
# Remove-QlikProfessionalAccessType
# Remove-QlikUserAccessType
# Remove-QlikAnalyzerAccessType
# if/else for iterating over the users
# If the tokenusers variable is null iterate over the p/a users, else token users
if (!$tokenusers) {
# P/A Model
ForEach ($user in $professionalusers) {
$licenseusers = ''
$licenseusers = Get-QlikUser -id $user.user.id
if ($licenseusers.removedExternally -eq 'False') {
# Users are removedExternally = True
Write-Output "Removing Professional license for $($user.user.userDirectory)/$($user.user.userId) (User Name: $($user.user.name))" | Out-File -FilePath $logfile -Append
Remove-QlikProfessionalAccessType -id $user.id
} else {
# Users are removedExternally = False
}
}
ForEach ($analyzeruser in $analyzerusers) {
$analyzerlicenses = ''
$analyzerlicenses = Get-QlikUser -id $analyzeruser.user.id
if ($analyzerlicenses.removedExternally -eq 'False') {
# Users are removedExternally = True
Write-Output "Removing Analyzer license for $($analyzeruser.user.userDirectory)\$($analyzeruser.user.userId) (User Name: $($analyzeruser.user.name))" | Out-File -FilePath $logfile -Append
Remove-QlikAnalyzerAccessType -id $analyzeruser.id
} else {
# Users are removedExternally = False
}
}
} else {
Write-Host "Token model"
}
> If i delete a user from User directory and then from QMC will his license automatically gets deallocated.?
Yes (as well as assign ownership of any apps, sheets, etc to sa_repository).
