11 Replies Latest reply: Sep 19, 2016 8:45 AM by Priyanka Sawant RSS

    Users cannot access hub - Inactive?

    Matthew Clements

      I've set up a User Directory Connector to my Active Directory environment for my Qlik Sense installation. This is a new install on a single server, and I only have two end users accessing this at the moment. Both end users report that when they access the hub, they are prompted for their AD credentials, then they just see a completely blank screen. When I access QMC > User Directory Connectors, I can see that the UDC is syncing successfully. In reviewing User Access Allocations, I can see licenses are allocated to both users. The Users page lists both users as well, however, it shows Inactive is set to 'Yes' and Removed Externally is also set to 'Yes'.

       

      Does Qlik disable inactive users causing this type of behavior? If so, how do I prevent this? How do I re-enable them so they can access Qlik again?

        • Re: Users cannot access hub - Inactive?
          Matthew Clements

          It appears as though my Active Directory user directory connector was causing this issue. Every time it synced, all users that were not root admin would show a 'removed externally' state of 'Yes'. I disabled this connector and users have since been able to access the site without issue, and new users can still navigate to the site where Qlik creates their domain account as a User so I can allocate a license to them. That being said, I'm a small environment who will have very few Qlik users, so I don't see value in keeping the user directory connector - I'll just set up privileges manually.

          • Re: Users cannot access hub - Inactive?
            Iain Rutgers

            I had the same issue and the options here did not help, ended up going to Qlik support on it. In our case the cause turned out to be the "Additional LDAP Filters" for active directory, the syntax that was used was not correct (I assume it may be an uncommon syntax). removing the filters allowed it to sync correctly.

             

            Another symptom for us, was very little details were synced for the users, they only had their login name shown in the user screen, afterwards the full name and user groups were populated.

            • Re: Users cannot access hub - Inactive?

              I have found that my problem was the LDAP filter that probably was in the wrong format. I was passing the path to the OU where the users are , like this:

               

              OU=SBSUsers, OU=Users,OU=MyBusiness,DC=MyDomain,DC=local

               

              I removed the LDAP filter, Synced and all users (including some service accounts I wanted to filter) showed up in seconds!

               

              What I should have, was a LDAP query to return users from a specific group, something like this:

               

              Example 1: (memberOf=CN=QlikPowerUsers,CN=Users,DC=example,DC=com) returns all users and their attributes who are

              members of the QlikPowerUsers group.

              Example 2: (&(objectCategory=person)(objectClass=user)(cn=Joe*)) returns all users and their attributes whose name begins

              with "Joe".

              Example 3:

              (|(memberOf=CN=QlikPowerUsers,CN=Users,DC=example,DC=com)(memberOf=CN=QlikReadOnlyUsers,CN=Users,DC=exa

              mple,DC=com)) returns all users and their attributes who are members of either QlikPowerUsers OR QlikReadOnlyUsers groups.

               

              More info about this on this very useful document:

              Qlik Sense Best Practice: User Directory Connectors

               

              Hope this also solved your problem!

               

              Best Regards,

              Carlos Silva