Currently Qlik Sense has been successfully integrated with ADFS as well as active directory. The issue is that users consume multiple tokens when logging onto the qlik sense hub internally vs.extranally. This create not only duplication of user on the QMC as well as the consumption of two tokens but also result people not able to access their workspace on the hub(My Work).
The users are treated separately dependent on UDC.
For us we have an internal (active directory) vs external Ole db user connection to ensure that the user only appears in one of the UDCs even though our internal users could come in the external one I've excluded them to avoid duplication.