Qlik Sense Enterprise on Windows moved to a new domain or server name changed: Convert Users To New User Directory

[Lisa_Sun]

Scenarios:

• Qlik Sense Enterprise on Windows has been migrated to a new domain. Bookmarks are no longer visible to users.
• The Qlik Sense server has been migrated to a new domain or assigned a new hostname. User records in the Qlik Management Console (QMC) refer to the previous user directory, which is no longer valid.

Accessing users will be identified according to new user directory, which can lead to duplicate user records. Depending on license allocation rules, there is also a risk that the same physical user will get a double user access allocation.

Please note that if direct assistance is required to implement these changes, Consulting Services will need to be engaged. See How and When to contact the Consulting Team. 

Resolution

This guide shows how to alter the user directory value by directly accessing the Qlik Sense Repository Database.  In this example the previous user directory OLDDOMAIN has been replaced with NEWDOMAIN.

Please note that if direct assistance is required to implement these changes, Consulting Services will need to be engaged. See How and When to contact the Consulting Team.

CAUTION: Direct change in the database are not supported and may cause irreversible corruption. Manual changes to the database must be executed with caution, and the system must be restored from backup at any symptom of system corruption.

1. Stop all Qlik Sense services, except the Qlik Sense Repository Database
2. Create a complete backup of Qlik Sense, to allow restoring the site in case of disaster
   Qlik Sense Help - Backup and restore
3. Connect to Qlik Sense Repository Database as described in article Installing and Configuring PGAdmin 4 to access the PostgreSQL database used by Qlik Sense 
4. Validate that connection is accurate by querying all users
   SELECT * FROM public."Users"
5. Change user directory name from old domain to new domain
   UPDATE public."Users"
   SET "UserDirectory" = 'NEWDOMAIN'
   WHERE "UserDirectory" = 'OLDDOMAIN';
6. Validate that intended change has been successfully applied to all affected users
   SELECT * FROM public."Users"
7. Start all Qlik Sense services
8. Confirm in QMC that users list shows the new domain as expected
   
   
9. Confirm in QMC that license allocation and allocation rules are accurate and match the directory change and allocation expectation
   
   
   
   
10. Login to Qlik Sense Hub with an authorized user from the “new domain”
11. Validate in QMC that the user access does not generate any duplicate entries, in the same view as in above steps 8 and 9.

[Lauri]

Do these instructions also apply when I change my user directory from connecting to Active Directory to connecting to an Excel file?

[Lauri]

As another option, could I delete my Active Directory UDC (name: 'VRHA') without deleting users and then name my new Excel UDC as 'VRHA'? The AD users are in the Excel file.

[Sonja_Bauernfeind]

Hello,

The same instructions would apply, but we recommend carrying this action out in a test environment prior to touching the production environment as these changes are done on database level, which should only be done with the proper testing done prior as well as with a fallback strategy (backup taken and ready to be restored) in place. 

Kind Regards,

Sonja 

[Lauri]

Thank you for the assistance, Sonja. I am testing this with a test account. After I go through the steps, I log into Qlik with my test account, and I end up with duplicates:

VRHA is the old directory name. In step 5, I set "UserDirectory" = 'VRHA2'

I use Okta for authentication (and have been for a few years).

[Damien_V]

@Lauri 

You would need to modify the configuration of the virtual proxy you use for OKTA authentication.

In there, you have a field "SAML attribute for user directory", this needs to be updated to your new User Directory, either as a static string [VRHA2] or as a dynamic SAML attribute (in that case that needs to be set up also in OKTA and included in the SAML assertion)

[balajim1]

@Lisa_Sun

Greetings for the day!

Are we allowed to make domain name changes in the Qlik Sense August 2022 SR2 version?

I hope we will not lose individual users bookmarks.

Kindly confirm the same.

Regards,
Balaji

[Sonja_Bauernfeind]

Hello @balajim1 

The instructions in this article apply to all versions of Qlik Sense Enterprise on Windows, including August 2022. You can change the domain name of the system you host Qlik Sense on, however, associations may be lost and you will need to follow through with the instructions in this article.

If you need direct assistance to have the domain name change planned and carried out for Qlik Sense, please contact our consulting services.

All the best,
Sonja 

[balajim1]

@Sonja,

Thank you for your support and update.

We changed the hostname, and we were able to cross-validate it through Qlik Sense Utility. However, we can't access QMC or Hub due to the below error.

Error:

There was an error contacting the license service. Keep retrying... (1 failed requests) GET /v1/licenses/overview StatusCode: InternalServerError Response: . Could not connect to the license service

Regards,
Balaji

[Sonja_Bauernfeind]

Hello @balajim1 

I have searched our knowledge base and located this article for you, which matches the symptoms and error you are sent over: Cannot open QMC or Hub "InternalServerError" and "Could not connect to the license service" 

Please review the content. Should this not help you resolve the issue, I recommend logging a support ticket and including all the information on what you have previously done (before the issue occurred, and after) as well as log files and screenshots documenting the issue.

All the best,
Sonja 

[giociva]

hi all,

back to this topic as I posted here some time ago.

I found out that this issue is recurring: when moving to a different domain seems that there is another field that has to be uppdated in the public.users table.

The field is:

UserDirectoryConnectorName

This field is by default populated with the "USERDIRECTORY" name.

The Users info show in QMC still show a UserDirectoryConnector named "OLD_USERDIRECTORY" preventing users to be correclty synchronized (User sync task terminates successfully but user info are not updated).

We found out that updating this field with an UPDATE postgresql query like:

UPDATE public."Users"
SET "UserDirectoryConnectorName" = 'NEW_USERDIRECTORY'
WHERE "UserDirectoryConnectorName" = 'OLD_USERDIRECTORY'

fix the problem.

Let me know your thoughts. Thank you.