Suggest an Idea

[jheisler]

Currently the Active Directory Groups of Active Directory users are saved in the following way:

User A is member of domain some.domain, Groups:
Group 1
CN=Group 2,OU=Groups,DC=other,DC=domain

"Group 1" is part of the domain some.domain and "Group 2" is part of the domain other.domain.

We do have users in multiple domains within the same group (which is part of only one domain) using Qlik. Because of that we always need to add two different Group names for the same Group in the section access Script.

Because of that our  section access script looks like this:

SectionAccess:
LOAD * inline [
REDUCTION, USERID, GROUP, ACCESS
10, *, 'Group 1', USER
10, *, 'CN=Group 1,OU=Groups,DC=some,DC=domain', USER
]

I would really appreciate if you could just save all groups, no matter in which domain they are, could be saved with there canoncial name or some other equivalent name convention which is the same for all domains.

[Jeffrey_Goldberg]

Hi there,

When I worked in pre-sales at Qlik a few years ago I ran into a similar issue. I worked with a customer to solve it using Powershell. Results varied, but here's the scripts I wrote in an attempt to resolve the problem.

https://github.com/eapowertools-archive/qs-odbc-udc-util

Unfortunately, user directory connectors in Qlik Sense aren't designed to handle the multi-domain / forest active directory. You could potentially roll your own connector using the connector api: https://help.qlik.com/en-US/sense-developer/June2020/Subsystems/UserDirectoryConnectorAPI/Content/Se...

Regards,

Jeff G

[Meghann_MacDonald]

Archiving due to age of idea and relevancy. If this is still required please resubmit the idea.

Meghann