User Directory Connector

[NeelanjanBasu]

Our platform users will log in to Qlik after JWT/SAML authentication, but as part of the authentication, we receive minimal user attributes.

To get the Qlik security rules working, we need more attributes attached to the identical SAML/JWT authenticated user (say under user directory AD).

Therefore, I configured UDC to connect to Excel (with user directory [AD]), having the same users with User directory [AD], hoping the users with the same userid under [AD] directory will be merged with SAMl/JWT AD directory but that's not happening.

Instead, it's treating the same user under two different user directories, as per the screenshot below.

If I created a UDC (connecting Excel) with AD (SAML/JWT user directory) instead of [AD], it throws an error that the user directory already exists, which is fine.

But the question is, how do we add a few extra users attributes to an authenticated user in Qlik? Even if Qlik treats the user under [AD] as a separate user entity, will it treat it as the same user from a security rule perspective?

[Bastien_Laugiero]

Hello, 

The reason is because the User Directory name needs to match the one associated to the user when he/she logs in to the Qlik Sense. 

Have you created two UDC? One called "[AD]" and one called "AD".

I understand "[AD] is an excel type but what type is "AD"?

Thanks!

[NeelanjanBasu]

Yes @Bastien_Laugiero we created two UDC.

The first UDC is getting the details for AD domain users (via LDAP), used for authentication.

The second UDC is getting some extra attributes for the same users under AD but from an Excel. 

Is there any way we can add user attributes from a different source ?

Incase we used SAML for user authentication (say with user directory AD ) will it possible to add some extra user attributes with an UDC ? If yes then what will be the user directory of the UDC ? Will it be [AD] ?  

[Bastien_Laugiero]

Hello! 

Thank you for your feedback!

You will not be able to use two different sources to get your user attributes. 

The only alternative as far as I know is to use session attribute where you can send attributes directly from your IDP when the user logs in and get Qlik Sense to recognize them.

Here is some documentation about it https://community.qlik.com/t5/Qlik-Design-Blog/User-Environment-What-Session-Attributes-in-Qlik-Sens...

Hope this helps!