4 Replies Latest reply: Nov 2, 2016 12:24 PM by Joachim Boivie RSS

    Sync with AD

    Mark Ritter

      Is there a way to limit the groups that sync back over to Qlik Sense from the AD UDC?

       

      I have created a group that identifies which AD users should sync in the first place.  For those that do sync I really only want the groups that pertain to QS to sync over.  They all begin with QLK-.  If the user belongs to 40 groups and only 3 of them are Qlik related I would like to just pull over those 3 and ignore the other 37.

       

      Is this possible to do?

        • Re: Sync with AD
          Vegar Lie Arntsen

          You should look at something called LDAP filters. Take a look at the Qlik help page https://help.qlik.com/en-US/sense/3.0/Subsystems/ManagementConsole/Content/use-additional-LDAP-filter-to-retrieve-specif…

           

          Personally I tend not to sync over users to Sense that have not already accesses the system. I only sync ad info on real Qlik Sense users. With this approach I don't need to configure filters on the AD and I don't clutter my user directory with to many users. You can still set your security rules using your Qlik AD groups as all groups and ad information will be fetched  when the user logs in the first time.

            • Re: Sync with AD
              Mark Ritter

              I have a filter that is limiting which users I sync back from the AD.  So that is not the issue.

               

              The question was of those that I do sync is there a way to limit how many groups come back into Qlik?

               

              For example:

              User A is a member of 40 groups in the AD.  Only 3 of those groups are QLIK groups that I care about.  Can I do something in the sync that recognizes only the Qlik groups and updates the user in Qlik with only 3 groups instead of all 40?

              Hope that makes better sense.

              Thanks

                • Re: Sync with AD
                  Vegar Lie Arntsen

                  Oh, then I missunderstood your question.

                   

                  I listened to conversation with a colleague a couple of months ago and I got the impression  that it is not possible to limit the AD-group lookups as you are suggestin.

                   

                  Correct me if I'm wrong joachim.boivie

                    • Re: Sync with AD
                      Joachim Boivie

                      @vegar, according the calls I participated with Qlik Support and Qlik developers all groups were syncronized for the users. You can of course set the filters for fetching users based on groups but all groups will be syncronized. Sense limit is 1.000.000 groups whiched was reached in this case