This article explains how to call the Graph API manually to verify group information.
This is based on how Qlik Sense SaaS code is fetching groups from Azure AD.
Qlik Sense for Windows straightly reads the groups from the ID token and if the number is too big, Azure AD will just include a link to the graph API in the ID token, which Qlik Sense for Windows will just ignore.
Environments:
Qlik Cloud
Resolution
FIrst of all, generate a token based on the steps in the below article.
Once the tokens generated, take the access_token (NOT the id_token) and use it to retrieve information from the Azure AD Graph API:
$access_token='eyJ0eXAiOi...CjAeMzpab_5QE2c5QZm0bA'
$hdrs = @{}
$hdrs.Add("Authorization","Bearer "+$access_token)
$url = 'https://graph.microsoft.com/v1.0/me/memberof'
$response = Invoke-WebRequest -Uri $url -Method Get -Headers $hdrs
echo $response.Content
Example of response:
{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#directoryObjects","value":[{"@odata.type":"#microsoft.graph.directoryRole","id":"605fd212-5945-4270-a4d5-e1e6ca65fbc7","deletedDateTime":null,"description":nu
ll,"displayName":null,"roleTemplateId":null},{"@odata.type":"#microsoft.graph.group","id":"43d6963e-a75f-46d7-87e4-99b95bb74877","deletedDateTime":null,"classification":null,"createdDateTime":"2018-08-31T14:24:21Z","crea
tionOptions":[],"description":"Qlik","displayName":"TestGroup","expirationDateTime":null,"groupTypes":[],"isAssignableToRole":null,"mail":null,"mailEnabled":false,"mailNickname":"cf40a8f3-47f6-4a3b-811b-e6028a9e21b9
","membershipRule":null,"membershipRuleProcessingState":null,"onPremisesDomainName":null,"onPremisesLastSyncDateTime":null,"onPremisesNetBiosName":null,"onPremisesSamAccountName":null,"onPremisesSecurityIdentifier":null,
"onPremisesSyncEnabled":null,"preferredDataLocation":null,"preferredLanguage":null,"proxyAddresses":[],"renewedDateTime":"2018-08-31T14:24:21Z","resourceBehaviorOptions":[],"resourceProvisioningOptions":[],"securityEnabl
ed":true,"securityIdentifier":"S-1-12-1-1138136638-1188538207-3113870471-2001254235","theme":null,"visibility":null,"onPremisesProvisioningErrors":[]}]}
Qlik Sense will fetch the odata type #microsoft.graph.group and fetch the displayName, then create the groups.
If there is more than 100 groups, the results will be paginated by page of 100 in the Graph API, Qlik Sense can fetch up to 10 pages (1000 groups).
