How to Filter Active Directory users when Synchronizing them with Qlik Sense Users

Andre_Sostizzo · Feb 10, 2021 8:29:57 AM

This article have example steps on how to filter Active Directory users when Synchronizing them with Qlik Sense Users.

For another example that uses "Active Directory Users and Computers" for testing filter strings, see Qlik Sense: Configuring and testing LDAP filters for User Directory Connector

Prerequisite:

I. Qlik Sense Service account is a domain user and a member of local Administrators group.
II. Qlik Sense Administrator account is a domain user and a member of local Administrators group.
III. Create these domain groups with appropriate members

1) QSUserAccess
2) QSLoginAccess

NOTE: The administrator account should be the member of both groups
e.g.
QSUserAccess = {QSAdmin, User1, User2}
QSLoginAccess = {QSAdmin, User3}

1. QMC > Start > User directory connectors, Press Create new

2. Select Active Directory

3. Name=AD and press Apply

4. Start > Tasks, Select AD_usersynctask, press Start

5. Press

[Refresh] icon and make sure the Status become Success

6. Start > Users, click next to your user name (e.g. Administrator)

Make sure that both QSUserAccess group and QSLoginAccess group attributes are synced

7. Use the Script attached to this article to get the LDAP filters
How to get LDAP filters for Active Directory groups
Run the script with PowerSchell

Output <date>-<hostname>-GroupLDAPfilter.txt will be generated

8. Compose the LDAP filter Syntax:

(|(memberOf=<QSUserAccess in step 7>)(memberOf=<QSLoginAccess in step 7>))

e.g.
(|(memberOf=CN=QSUserAccess,CN=Users,DC=domain,DC=local)(memberOf=CN=QSLoginAccess,CN=Users,DC=domain,DC=local))

See this article to create and test the filter by using 3rd party tool
Qlik Sense on Windows: Configuring and testing LDAP filters for User Directory Connecto

If your LDAP filter happens to exclude you, then you won't be able to access QMC. See this article to recover.
Admin Account Disabled After LDAP Filter Added

9. QMC > Start > User directory connectors, select AD, press Edit

10. Enter these and press Apply
Name=AD
Sync user data for existing users = <Clear>
Additional LDAP filter = <Composed LDAP filter in step 8>