Official Support Articles

[Damien_Villaret]

The Identity Provider validation succeeded but users are getting the following error when trying to log in with Azure AD:

{"errors":[{"title":"Authentication failed","code":"LOGIN-1","status":"401"}],"traceId":"00000000000000000564e98ec48dd227"}

The Qlik internal logs show:

"error","message":"Failed to fetch extra claims Insufficient privileges to complete the operation.","stack":"Error: Insufficient privileges to complete the operation.\n    at new GraphError (/usr/src/app/node_modules/@microsoft/microsoft-graph-client/lib/src/GraphError.js:31:28

Note that these log files are not customer-facing. For further assistance, please contact support.

Resolution:

This is because Qlik Sense doesn't have the correct permissions to read group membership from Azure.

1. If you do not need group membership to be imported in Qlik Sense, disable "Enable creation of groups" in the "Settings" section in the Qlik console.
   
   
   
   
2. If you need the groups, assign the proper rights in Azure for Qlik Sense to be able to fetch them.

See the link at the end of this article.

Cause:

"App registration" in Azure has not been configure correctly to grant "Admin consent" for the Graph API GroupMember.Read.All, when set up correctly this should looks like the following:

If there is a yellow warning sign, ask your Azure admin to grant Admin consent for the Enterprise application linked to this app registration.

Azure Active Directory > Enterprise applications > select the enterprise application that has the same name as the app registration and go to the "Permissions" tab in the security section. 

Click on "Grant admin consent for <Tenant name>" to grand the admin consent for your app registration.

https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/grant-admin-consent

[Hornstrup_83]

Hi Damien, 

We've managed to set this up, and had this error. Resolution 1 solved this for us, but we want to be able to use groups. 

We've done the config in Resolution 2, but still get the error. Is there a way we can see the error message in the internal Qlik logs? I don't find these in the Cloud QMC - only events that does not seem to hold this information.

All the best.

[Sonja_Bauernfeind]

Hello @Hornstrup_83 

This error is being sent in our internal Qlik Cloud logs. I would advise contacting support (through chat, just use the "Contact Support" button) to log a ticket with our product support to assist you further.

All the best,
Sonja