How to test if the LDAP Filter is returning the expected users
How to test if the LDAP Filter is returning the expected usersVersion:1Date: 2015-11-06Qlik SenseDisclaimer:Please be aware that this document is not supported and is meant only as a guide.? Individual environments may require adjustments for things to work correctly.? This will/may require altering and customizing code shipped with QlikView Server/Sense Enterprise. All customization is done at your own risk and is not covered by Qlik Support or Maintenance Agreements. ?Please backup any files prior to modification.Table of Contents TOC \o "1-3" \h \z \u 1Introduction PAGEREF _Toc434829670 \h 41.1Setup to test LDAP filter PAGEREF _Toc434829671 \h 41.1.1Using MMC to view Active Directory Users and Computers snap-in PAGEREF _Toc434829672 \h 42Testing an LDAP Filter PAGEREF _Toc434829673 \h 82.1It is all about the syntax PAGEREF _Toc434829674 \h 82.1.1Using the MMC to ensure the LDAP filter returns what is expected PAGEREF _Toc434829675 \h 82.2Using LADP Filter in Qlik Sense PAGEREF _Toc434829676 \h 14IntroductionWhen working with Qlik Sense, there are a few ways to get users into the Users section of the QMC. When a user accesses the Sense Hub, they will automatically be added to the Users section. This does not mean they will be given a token (User or Login access) automatically, this is material for another document, and is not covered here.Once the Active Directory (AD) is created, the users in the AD can be pulled in. However, without a filter ALL, the users in the AD will be pulled in. If you have thousands of users this is probably not the optimal situation. Option one is good, but users have to first access the hub. Option two is problematic as there may be users in your table structure that really need not be there.Using an LDAP filter to limit only the users necessary to be imported is a good alternative. The purpose of this document is to outline how to test an LDAP filter before applying to Qlik Sense, allowing confirmation the correct users will be imported.LDAP filters can vary in need and syntax, this document will not go into how to determine your particular string, but will cover how to test it is correct and functional. Individual IT departments should be able to assist in the creation, etc. Additionally, there are several resources online that may assist with the creation. Here is a helpful link: to test LDAP filterUsing Microsoft Management Console(MMC) to view Active Directory Users and Computers snap-inDisclaimer – Company policy, etc. may prevent the installation and configuration of items outlined below. It may be necessary to contact local IT resources to provide the proper syntax.The items below are based upon a Windows 7 desktop, but apply to server 2008/R2 and 2012/R2 as well.On the windows 7 machine, it is necessary to install the Remote Server Administration Tools for Windows 7 w/ Serivce Pack 1 (SP1) the installation is complete, the following steps need to be completed:From Start > Run, type MMC and press enter.The MMC will be presented.Click File > Add/Remove Snap-in...Select Active Directory Users and Computers and click Add, the selection will be placed in the right-hand window.Select OK.The following dialog will be presented.Expand Active Directory Users and ComputersThe Active Directory Listing will appearThe snap-in needed to check you LDAP filter has been successfully added.Testing an LDAP FilterIt is all about the syntaxUsing the MMC to ensure your LDAP filter returns what you expectCreating an LDAP filter can be complicated, and the assistance of IT or Google search may be required to get the syntax correct. This document is not meant to be a primer on LDAP syntax, but with a bit of trial and error things can generally be resolved.When creating an LDAP filter, the purpose is to generally only pull a subset of users. To make things easier, it is helpful if a group for Sense users is created. This way a single item may be referenced and as users are added to the group they will be pulled in when the LDAP synchronizes. The following steps outline how to test a potential LDAP filter and verify the correct Users are returned.With the MMC opened in the steps above, right-click the domain name and select FindThe following dialog will be presented showing Find Users, Contact, and GroupsIn the Find Box, change the drop-down to Custom SearchChange the tab selection from Custom Search to AdvancedAn LDAP query may now be pasted in the dialog to be testedThe example below will search for users in a Group named SenseUsers:(&(objectClass=user)(memberOf:1.2.840.113556.1.4.1941:=CN=SenseUsers,CN=Users, DC=domain,DC=local))Multiple groups my be querried as well: SenseUsers and SenseUsers2(&(objectClass=user)(|(memberOf:1.2.840.113556.1.4.1941:=CN=SenseUsers,CN=Users,DC=domain,DC=local )(memberOf:1.2.840.113556.1.4.1941:=CN=SenseUsers2,CN=Users,DC=domain,DC=local)))Addtionally, searches for groups within organizational units (OU) may be carried out(&(objectClass=user)(memberOf:1.2.840.113556.1.4.1941:=CN=Blah,OU=Groups,OU=Medical Center,OU=UCSD Healthcare,DC=domain,DC=local))Almost any type of filter string can be tested to verify if the correct users are returned before applying the filter in Sense.There are several tools that can be used to help create your syntax, a Google search for LDAP browser provides a good list of tools. Sysinternals has Active Directory Explorer, which works quite well. recommending any particular tool over any other.Keep in mind if the Windows search returns no users or errant results, these will be the same results in Sense.Using LDAP Filter in SenseThe LDAP filter now needs to be applied in Sense via the QMC so users are filtered and loaded correctly.Open the QMC for the environmentNavigate to Start > User Directory Connectors, edit your Active Directory entry.Once in the AD entry, select the Advanced option, this allows for the entry of the filter into the Additional LDAP filter fieldPaste the filter into the field. Ensure the option for User Sync Settings: Fetch user data on first access, then keep in sync is unchecked. By unchecking this option, the users will be retrieved as outlined by the filter and they will populate the Users section of the QMC (leaving it checked will only sync users already in the section).Click ApplyAs seen below the example filter retrieves four users from two groups (SenseUsers and SenseUsers2)Those users do not exist in the Users section of the QMC, with the exception of User1.To get the users into Sense, the sync task for the Active Directory connector needs to be executed.Go to Start > TasksSelect the Task for the Active Directory connectorStart the taskOnce the task has completed, check that the Users section contains the users that have been synchronized.Note: Any users that were already in the Users section will remain, the filter will not remove them.If new users are added and should be picked up by the filter, they will not show in the Users section until the synchronization task is run again (either manually or via schedule)Conversely, to remove a user, they must be manually removed via the Users section of QMC. It is highly recommended that any user access licenses assigned to the user be removed (quarantined) prior to deleting the user. ................
................
In order to avoid copyright disputes, this page is only a partial summary.
To fulfill the demand for quickly locating and searching documents.
It is intelligent file search solution for home and business.
Related download
- active directory integration
- step by step guide to managing the active directory
- when a computer joins an active directory domain for
- computer engineer
- how to test if the ldap filter is returning the expected users
- creating gpo s for msi installation
- system administrator interview question with answer latest
Related searches
- how to tell if it s pink eye
- how to know if he s the one
- how to know if website is secure
- how to know if you hate someone
- how to calculate if refinancing makes sense
- how to know if you should divorce
- how to tell if he loves you
- how to know if he loves me
- how to tell if i have pneumonia
- how to tell if struts need replacing
- how to tell if struts are bad
- how to tell if someone is evil