Import LDAP users task test fails

[keerthi_g]

Hello everyone,

We are trying to create an import task for LDAP users on NPrinting November 2018 version.

Once the task is created and saved, test now operation fails with the below error

Testing import of filters and recipients for task with id eb378872-59d9-417d-9dcb-fd8ef03fcfc3.
Importing data from source 1
Importing recipients and groups from ldap server ldap://XXXXXXX as cn=directory manager
ERROR: The search request cannot be processed because it contains a critical control with OID 1.2.840.113556.1.4.319 that is not supported by the Directory Server for this type of operation ---> The server does not support the control. The control is critical.

LDAP server we are trying to send the request to supports pagination of results.

I have tried to fetch the logs at "DEBUG" level on the scheduler and got the below information

Product Assembly Name Product Version Class Name Timestamp Severity Hostname User name User ID WebEngine Request ID Connection ID Task ID Execution ID Report ID Request ID Transformation ID Message Exception Stacktrace
Qlik.NPrinting.Scheduler XXXX  Qlik.NPrinting.Scheduler.SchedulerHttpService 20190519T192001.891-04:00 INFO XXXX 0 0 0 0 0 0 0 0 Starting up scheduler service
Qlik.NPrinting.Scheduler 18.39.6.0 Qlik.NPrinting.Scheduler.SchedulerCore 20190519T192006.766-04:00 WARN XXXXX Nprinting Task Identity 0 0 0 0 0 0 0 0 Engine c40782ef-74b1-40c5-acc1-eeb9eaa48a26 has reached heartbeat timeout. Last recorded heartbeat: 5/19/2019 11:18:15 PM - Offline thresold: 00:00:15
Qlik.NPrinting.Scheduler 18.39.6.0 Qlik.NPrinting.Scheduler.SchedulerHttpService 20190519T192006.891-04:00 INFO XXXXXXXXX Nprinting Task Identity 0 0 0 0 0 0 0 0 Scheduler service started successfully
Qlik.NPrinting.Scheduler 18.39.6.0 Qlik.NPrinting.Scheduler.Service.LoadBalancer 20190519T192007.438-04:00 WARN MDMDEV2QKVE1A02 0 0 0 0 0 0 0 0 Receiving allocation from unknown engine c40782ef-74b1-40c5-acc1-eeb9eaa48a26. Message will be discarded
Qlik.NPrinting.Scheduler 18.39.6.0 Qlik.NPrinting.Scheduler.Task.ImportFiltersAndRecipientsEngineTask 20190519T192034.265-04:00 INFO XXXXXX Nprinting Task Identity 0 0 0 eb378872-59d9-417d-9dcb-fd8ef03fcfc3 05046369-c7da-4687-ac7c-4d37e2c6af38 0 0 0 Testing import of filters and recipients for task with id eb378872-59d9-417d-9dcb-fd8ef03fcfc3.
Qlik.NPrinting.Scheduler 18.39.6.0 Qlik.NPrinting.Scheduler.Task.Import.ImportStepLdapConnector 20190519T192034.343-04:00 INFO XXXXXXX Nprinting Task Identity 0 0 0 eb378872-59d9-417d-9dcb-fd8ef03fcfc3 05046369-c7da-4687-ac7c-4d37e2c6af38 0 0 0 Importing recipients and groups from ldap server ldap://XXXXXXXX as cn=directory manager
Qlik.NPrinting.Scheduler 18.39.6.0 Qlik.NPrinting.Scheduler.Task.ImportFiltersAndRecipientsEngineTask 20190519T192034.577-04:00 ERROR XXXXXX Nprinting Task Identity 0 0 0 eb378872-59d9-417d-9dcb-fd8ef03fcfc3 05046369-c7da-4687-ac7c-4d37e2c6af38 0 0 0 ERROR: System.DirectoryServices.Protocols.DirectoryOperationException: The search request cannot be processed because it contains a critical control with OID 1.2.840.113556.1.4.319 that is not supported by the Directory Server for this type of operation ---> System.DirectoryServices.Protocols.DirectoryOperationException: The server does not support the control. The control is critical.↓↓   at System.DirectoryServices.Protocols.LdapConnection.ConstructResponse(Int32 messageId, LdapOperation operation, ResultAll resultType, TimeSpan requestTimeOut, Boolean exceptionOnTimeOut)↓↓   at System.DirectoryServices.Protocols.LdapConnection.SendRequest(DirectoryRequest request, TimeSpan requestTimeout)↓↓   at Qlik.NPrinting.Scheduler.Task.Import.ImportStepLdapConnector.<PagedSearchIterator>d__21.MoveNext() in C:\Jws\release-18.39.x-w104zyghT\server\NPrinting\src\Scheduler\Task\Import\ImportStepLdapConnector.cs:line 1191↓↓   at System.Linq.Parallel.PartitionedDataSource`1.ContiguousChunkLazyEnumerator.MoveNext(T& currentElement, Int32& currentKey)↓↓   at System.Linq.Parallel.SelectQueryOperator`2.SelectQueryOperatorEnumerator`1.MoveNext(TOutput& currentElement, TKey& currentKey)↓↓   at System.Linq.Parallel.SelectManyQueryOperator`3.SelectManyQueryOperatorEnumerator`1.MoveNext(TOutput& currentElement, Pair`2& currentKey)↓↓   at System.Linq.Parallel.WhereQueryOperator`1.WhereQueryOperatorEnumerator`1.MoveNext(TInputOutput& currentElement, TKey& currentKey)↓↓   at System.Linq.Parallel.WhereQueryOperator`1.WhereQueryOperatorEnumerator`1.MoveNext(TInputOutput& currentElement, TKey& currentKey)↓↓   at System.Linq.Parallel.SelectQueryOperator`2.SelectQueryOperatorEnumerator`1.MoveNext(TOutput& currentElement, TKey& currentKey)↓↓   at System.Linq.Parallel.WhereQueryOperator`1.WhereQueryOperatorEnumerator`1.MoveNext(TInputOutput& currentElement, TKey& currentKey)↓↓   at System.Linq.Parallel.SortHelper`2.BuildKeysFromSource(GrowingArray`1& keys, List`1& values)↓↓   at System.Linq.Parallel.SortHelper`2.Sort()↓↓   at System.Linq.Parallel.OrderPreservingSpoolingTask`2.SpoolingWork()↓↓   at System.Linq.Parallel.SpoolingTaskBase.Work()↓↓   at System.Linq.Parallel.QueryTask.BaseWork(Object unused)↓↓   at System.Threading.Tasks.Task.Execute()↓↓   --- End of inner exception stack trace ---↓↓↓↓Server stack trace: ↓↓   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()↓↓   at Qlik.NPrinting.Scheduler.Task.Import.ImportStepLdapConnector.Import() in C:\Jws\release-18.39.x-w104zyghT\server\NPrinting\src\Scheduler\Task\Import\ImportStepLdapConnector.cs:line 1995↓↓   at Qlik.NPrinting.Scheduler.Task.ImportFiltersAndRecipientsEngineTask.<>c__DisplayClass7_5.<RunInternal>b__10() in C:\Jws\release-18.39.x-w104zyghT\server\NPrinting\src\Scheduler\Task\ImportFiltersAndRecipientsEngineTask.cs:line 111↓↓   at System.Threading.Tasks.Task`1.InnerInvoke()↓↓   at System.Threading.Tasks.Task.Execute()↓↓↓↓Exception rethrown at [0]: ↓↓   at System.ExceptionExtensions.RethrowInnerException(AggregateException this, Boolean firstException, Boolean flatten, Boolean ifInnerExceptionIsNullRethrowThis) in C:\Jws\release-18.39.x-w104zyghT\server\NPrinting\src\Qlik\Qlik.Reporting.Common\System\ExceptionExtensions.cs:line 290↓↓   at Qlik.NPrinting.Scheduler.Task.ImportFiltersAndRecipientsEngineTask.<>c__DisplayClass7_0.<RunInternal>b__5(ImportFiltersAndRecipientsData data, <>f__AnonymousType5`5 t) in C:\Jws\release-18.39.x-w104zyghT\server\NPrinting\src\Scheduler\Task\ImportFiltersAndRecipientsEngineTask.cs:line 127↓↓   at System.Linq.Enumerable.Aggregate[TSource,TAccumulate](IEnumerable`1 source, TAccumulate seed, Func`3 func)↓↓   at Qlik.NPrinting.Scheduler.Task.ImportFiltersAndRecipientsEngineTask.RunInternal() in C:\Jws\release-18.39.x-w104zyghT\server\NPrinting\src\Scheduler\Task\ImportFiltersAndRecipientsEngineTask.cs:line 92 

I have restarted the server and all the NPrinting services with no luck.

We are able to successfully connect and import users from the same LDAP directory server on QlikSense.

Please let us know if anyone has experienced this on their environment and the possible solution for this issue.

Any help is highly appreciated!!!

Thanks,

Keerthi

[Alexis_Touet · Accepted solution]

Hi, 

Are you trying to sync from active directory ?

From the screenshot you sent I believe some attributes are incorrect (ex: group membership CN)

I have tested an import from an internal Lab server and it has been working with the following attributes - see attachment. 

In the Test I have run, I was trying to import only users member of an active directory group called "NPrinting_all_users"

Users stored in : ldap://domain.local/OU=Employees,DC=domain,DC=local

NPrinting groups stored in : OU=QlikNPrinting,OU=Qlik,OU=Business_intelligence,DC=domain,DC=local

Distinguished name of  "NPrinting_all_users" : CN=NPrinting_all_users,OU=QlikNPrinting,OU=Qlik,OU=Business_intelligence,DC=domain,DC=local

For the sync to work I have set NPrinting as follows:

Connection path : ldap://domain.local/OU=Employees,DC=domain,DC=local

Username & password : An account with sufficient permissions on AD. 

Alternative group path: OU=QlikNPrinting,OU=Qlik,OU=Business_intelligence,DC=domain,DC=local

Additionnal user filters : memberof=CN=NPrinting_all_users,OU=QlikNPrinting,OU=Qlik,OU=Business_intelligence,DC=domain,DC=local

In order to understand which attributes to use, I recommand:

1) Use a third party LDAP browser like LDAP admin to check from your NPrinting server the attributes of your environment

http://www.ldapadmin.org/

2) Test your filters from an LDAP browser tool, or active directory directly if you have access  (find in custom search > advanced tab)

3) If you are still unable to set this up, contact your IT department responsible of your LDAP

Hope this helps. 

Best regards, 

Alexis 

[keerthi_g]

Hi Alexis,

Thank you for your response.

We made a change to the connection path ldap://domain.local/OU=Employees,DC=domain,DC=local as per your suggestion and have kept our group=cn.

This solved our issue and we were able to successfully import users from LDAP.

Thanks for the solution!!!

Regards,

Keerthi