What is the intended purpose of a User Directory Connector?

[mbespartochnyy]

I've done a lot of reading on this topic, took Qlik's Deploy and Administer Qlik Sense training, watched a bunch of videos and I still don't really understand what the purpose of a User Directory Connector or how it is intended to work and be used.

To make the question more specific, let's say we're talking about an install of Qlik Sense on a server that is part of a domain and has active directory with say 10,000 user accounts.

Furthermore, let's say we're working with a fresh install of Qlik Sense that has no users other than the one user account that was used to install Qlik Sense and the internal Qlik Sense service accounts.

I want to bring in the 10,000 user accounts and their attributes from active directory and have them all show up in Users section of QMC.

I created User Directory Connector, unchecked the Sync user data for existing users checkbox, provided LDAP path:

I then created a task, kicked off the task, the darn thing ran for more than five hours, completed successfully. I went to Users section, no change in user count. I still only see the default Qlik service account and the one user account that I used to install Qlik Sense.

I know that the UDC did its job because before the user sync task, the user account that was used to install Qlik Sense didn't have any user groups information and after the install it did. It listed all of the groups the account is part of.

I also know that it works because if I list out specific users in the Additional LDAP filter box, those user along with their attributes are getting imported from active directory.

I was under impression that if I leave the Advanced LDAP filter blank, it will bring in the entire user directory, all of 10,000 users and will list them out in Users section of QMC, but it didn't.

So what's the deal? Is UDC meant to:

• Import users and user attributes

or

• Is it meant to just look up and import user attributes for existing users?

Also, what is going on with Advanced LDAP filter?? "Filter" in my mind deals with reduction, as in "here's a filter to bring in 100 user accounts and not the whole set of 10,000." I expected that when filter is available, a reduced number of users would be returned. If filter is not available, the whole active directory would be imported, but that doesn't seem to be the case. Am I missing something?

Thanks in advance for taking the time to read through all that and for any input on this that can add clarity to how UDC is meant to work when it comes to user import from AD.

Mikhail B.

[micheledenardi · Accepted solution]

Dear Mikhail,

i think it has no sense to load 10K users in Qlik if only a part of them has to use qlik.

In order to maintain you Qlik environment clean and fast I suggest to create a sort of "Qlik Users" domain group and associate to this group only the users who have to use qlik, then setup and Advanced Filter to fetch only users which are member of this group.

Maybe this will resolve also your problems and your synchronization will be definitely faster.

Let's try

[mbespartochnyy]

Thanks for the reply @micheledenardi ! Your solution is a good one and I do use an LDAP filter to bring in users that I are meant to be using Qlik Sense. It's working fine, I'm just confused by the fact that absence of a filter results in no users being brought in.

The Qlik training I took on this topic showed that without an LDAP filter all users in Active Directory were brought in. The flow of the training was:

1. Bring all of the users in.
2. Select individual user and allocate a license.
3. Oh by the way, here's a way to create rules to automatically allocate license to a group of users.

It made sense. Add users > setup users > allocate licenses.

That step one, however, after following the instructions and creating a directory connector which I was expecting to bring in all the users, as was shown during training, it did not do that. So, naturally, I though:

"Wait why didn't that work? If that doesn't work, how do I add a user. That's step one in the process. Adding users should be a thing...a very easy and straightforward thing. Why is it not a very easy and straightforward thing?"

I imagined the process to be:

1. Import users using a directory connector.
2. Pick user.
3. Setup user with appropriate custom properties and whatnot.
4. Allocate a license to a user.
5. Send a user a friendly email telling them that all is set for them to log on and start using the apps permissioned for them to be used.
6. User logs on without problems and starts using the apps.

But again, in step one, directory connector doesn't actually bring in all of the users even though in the training it was shown that it does. Which brings me here with the question, "What is the intended purpose of a User Directory Connector?"

It's not that I don't have a solution for bringing in users that I need to bring in, it's that I don't really understand what is the intended purpose for the UDC and why is it not bringing in all of the users?

[micheledenardi]

Dear Mikhail,

in both my environments if i remove LDAP fileters all domain users are loaded into qlik automatically.

Don't know why in your case this doesn't work. Which QlikSense version do you have?

[mbespartochnyy]

I'm on April 2020.

Could it be that there is a limit to number of users that is permitted to be loaded? For example, if active directory contains more that 1,000 users it doesn't bring in any.

[micheledenardi]

There is no limit in terms of amount of users, tried right now to remove LDAP filerts and i fetch  19418 users.

I check release notes from April 2020 till last version but i didn't find any bug reported  about users import with UDC.

Try to user an AD tool (https://docs.microsoft.com/en-us/sysinternals/downloads/adexplorer) to check if your user has the correct rights to perform a generic query on your domain.

Don't know if this help but here you can find  the best practice for UD connector: https://community.qlik.com/t5/Qlik-Sense-Documents/Qlik-Sense-Best-Practice-User-Directory-Connector...

[mbespartochnyy]

I see, that helps! Thanks for giving that a try! It must be something on my end then.

I've tried pulling user list without LDAP filter and got the same result on two different Qlik servers so I assumed there was some disconnect or change done recently to the user directory connector that made it behave differently from what I was reading in documentations and seeing in training. I'll keep digging to see what's preventing me from pulling down list of all users.

Thanks again for all your feedback and for confirming UDC behavior without LDAP filters!