SAML attribute in section access

[fjuken]

Hi,

Configured Integration from Qlik Sense onPrem towards Azure AD.
Access to QMC and Hub works fine using security rules , but when I access a app i get 'access denied'.
Based on documentation it should be possible to reUse the SAML 'group' attribute in access script, right?

Please advice!

[Eugene_Sleator]

HI @fjuken in order for this to work you need to include the Group attribute in the Virtual Proxy. Please refer to these Qlik articles for an explanation;

Qlik Sense: Section Access not working with SAML attributes 

User-Environment-What-Session-Attributes-in-Qlik-Sense 

Section-Access-User-Attributes 

Hope this helps

 

[fjuken]

Thanks for reply, @Eugene_Sleator !

We've configured following on the virtual Proxy (we're sending group objects from AzureAD as attribute 'group')

Using this proxy for access to QMC and HUB works as expected, but when we try to access apps we get 'Access Denied'

We tried different combinations of adding this to the access script, as you see an example of in the post, both linking to group attribute and the username of the SAML authenticated user ++ but we're not able to get access to the app using SAML authentication.. 

Br,

Håvard Fjukstad.

[Eugene_Sleator]

Hi @fjuken can you try with the "SAML attribute" set to groups NOT group 

[fjuken · Accepted solution]

Hi @Eugene_Sleator 

Seems like our issue is related to casing.
After adding this to the access script we managed to login and access app.

_sa:
LOAD Upper(ACCESS) AS ACCESS,
Upper(USERID) AS USERID,
Upper(GROUP) AS GROUP,
Upper(%SAKEY) AS %SAKEY
Inline [

Br,
Håvard Fjukstad.