Qlik Community

Qlik Sense Documents & Videos

Documents & videos about Qlik Sense.

Syncing windows AD users from Qlik Sense to NPrinting

Employee
Employee

Syncing windows AD users from Qlik Sense to NPrinting

If you use a windows a Active Directory UDC to import and manage users in Qlik Sense, then among other things , Qlik Sense will store the windows UserID, User Name, Directory, AD group memberships, and email address of the users inside the Qlik Sense repository. Usually the important 'domain account' of a user in NPrinting is nothing more than the Directory\UserID drawn from Qlik Sense.   Since NPrinting requires just a few more attributes of the user (default locale , timezone and a generic password which can be hard coded to default values or loaded from another source like a database or spreadsheet) , the Qlik Sense repository can be used as an effective source of users to import into NPrinting. It works especially well when the NP users are already QLIK users which occurs with on-demand use cases.

The Qlik Sense repository is accessible through the QRS REST API and the users + user attributes (including emails and groups) can be read directly through the Qlik Sense REST Connector inside the data load editor.  You can author a new REST connection or you can simply use the built in "monitor_apps_REST_user"  data connection that is setup automatically when you first install Qlik Sense.  Just note that this connection is used by the default monitoring apps and is configured by default to work only on a central node .  You need to reconfigure the data connection to work in a multinode qlik sense environment

https://help.qlik.com/en-US/sense/June2018/Subsystems/Monitoring/Content/Troubleshooting/troubleshoo...

So what happens once you can read the users + attributes into a Qlik Sense load script ?

Well,  you can then use Gianluca's wonderful reference document How to use Qlik NPrinting APIs inside a Qlik Sense load script  and the attached sample to inject the same users through the same REST Connector and a data connection that points this time to the NPrinting API to create / update / delete  or in short, manage, your users in NPrinting.

Please note the 2nd half of this technique can be applied with ANY accessible Qlik source to load users into NPrinting.

Now although the technique involves script, the benefits is that the syncing can be done by simply scheduling a Qlk Sense Task and/or chaining upon success/failure of another Qlik Sense task.  So you get to operate Qlik/NPrinting through a single scheduler.

Another benefit is that using this and other reference methods you can unlock the REST API without being a REST developer because you re-use Qlik load script techniques using the out of box Qlik Sense, NPrinting and REST Connector products/components.  This untaps more automation in how you operate NPrinting with Qlik Sense and can provide more nuance than a standard featurized solution .

Sample


The technique is dependent on the foundational approach outlined in this post  https://community.qlik.com/thread/292037  .

  • Components of the solution

                Capture.PNG

    • A REST Connector GET connection to the NPrinting API
    • A REST Connector POST connection the NPrinting API
    • The "monitoring_apps_REST_user"  REST Connection used by the monitoring apps to connect to the QRS API
    • Qlik script with the following sections

  • Setup

      1. Ensure QLik Sense Feb 2018+ and NPrinting are installed and setup.
      2. Import the attached app
      3. Create two NPrinting REST connections .    (Refer to pages 8-11 of the document  "How to use NPrinting APIs within a Sense load script"  )     https://community.qlik.com/thread/292037
      4. Record the two names of the REST connections you create and enter the NAMES of the REST Connector connections on line 29 and 30 of the 'Setup' section of the load script below

        Capture.PNG

      5. On line 34 , enter the name of your 'monitor_apps_REST_user'  REST connection to the QRS API. on line 34.
      6. On line 38,  enter  'True' if you use https to access NPrinting or 'False' if you use http to access NPrinting
      7. On lines 39 and 40, enter the server:port of the NPrinting Web Console and Qlik Sense Hub respectively
      8. On line 44, enter the directory of the users you would like to sync from QLik Sense to NPrinting

        for example, in the Qlik Sense QMC there are multiple directories of users .  Pick the directory of users you would like to sync.

Capture.PNG

      1. On lines 45 , 46, and 47 , enter 'True'  if you want to create users in NPrinting , update existing users in NPrinting, and/or  delete existing users in NPrinting

        create = true:    Any valid user present in the Qlik Sense repository and directory will be created in NPrinting during the sync if they don't already exist in NPrinting
        update = true:   If an NPrinting user already exists in NPrinting , update the user with the latest settings during the sync
        delete = true:    delete all users (except a named administrator) from NPrinting unless they exist in Qlik Sense

      2. On line 48 and 49,  enter the current email address and name used by one adminstrator that ALREADY EXISTS in the NPrinting repository.  NPrinting requires one admin at all times. For that reason, this user will always be skipped, it won't be updated or deleted.

      3. On lines 58-62 , provide default settings for the remaining required recipient attributes.  NPrinting recipients will be created with these defaults.

      4. Please note that creates and updates will also update the DOMAIN ACCOUNT of the NPrinting recipient using the directory and userid properties from qlik sense.

The above solution will sync USERS from Qlik Sense to NPrinting.  A logical enhancement would be to sync GROUP memberships from Qlik Sense.  In NPrinting,  'groups' are just recipient groups that bucket recepients together for report delivery whereas

'security roles' define which capabilities and content the recipients can see. So .. .when you sync groups you could sync them to groups memberships or role memberships depending how/if you may want to leverage existing AD group memberships.

Another enhancement would be to sync and update user filters.  THis is also readily possible by loading the necessary data tables and data values into the QLik Sense app so they can be associated to users and prepped for update into the NPrinting API.

Attachments
Comments
Partner
Partner

Nice one! I can see that it offers more flexibility rather than the new LDAP import, e.g. Admin groups and similar. Or have you found a way to do that in the new import tool?

0 Likes
Employee
Employee

Hi Erik ,  i was able to import groups from LDAP and update group membership of the users.  I am looking into whether we can import 'security roles' . I was able to update user membership of pre-existing security roles but not yet import/create new security roles.  Creating security roles is also not available in the current REST API  and in our ldap import feature i do not see a list of capabilites that would define the capabiltis of a security role (like which app the role affects, read/write access to reports etc...).

I'll seek guidance on where we can define a master list of security roles (outside of the NP repository)

UPDATE 

I put together this slide to help show the flow of what you can sync from LDAP, what needs to be done with the console (roles) and what you might use to keep track of user filters if necessary

Capture.PNG

0 Likes
Partner
Partner

Nice!

So as long as we create the roles beforehand, and use the same value for the role in the import, it should work, eh?

0 Likes
Employee
Employee

thats right.  works like that across the board for import tasks using LDAP or Excel. It also works via the API with or without the nifty load script/rest connector technique in this original post.

Version history
Revision #:
1 of 1
Last update:
‎2018-08-21 04:16 PM
Updated by: