4 Replies Latest reply on Dec 9, 2013 8:09 AM by Toby Erkson

    Number of levels an AD import will go down.

    Toby Erkson

      I asked Tableau Support how many levels down an AD import will pull.  I need to know this since we have AD groups that can have zero to many sub-groups.  I do know that it will pull in people from the first sub-group but if that sub-group has groups in it, will the users in those also get pulled in?  From what I gleened by the short answer is that the first sub-group people will get pulled in but beyond that they have no idea

       

      Support answer:

      "Tableau Server only will reliable pull in active directory users in a top level group.  If the users exist in a sub group they will be pulled into the top level group within Tableau Server.  Past a sub group Tableau Server may not be able to find the user."

       

      If anyone can confirm/deny please add to this post so we know for sure.

        • 1. Re: Number of levels an AD import will go down.
          Ken Patton

          I personally have synced to an AD tree of over 30,000 userid's in a hierarchy about 14 or 15 deep. It's fair to say, however, that we had encountered some bugs along the way and didn't really get past them until at least the 8.0.4 release or so. It's not something I recommend folks do, but yes it is possible.

           

          Your chances of success or failure really hinge on the reliability and speed of both your AD Domain Controller(s) and the network between your Tableau Server and said Domain Controller. Assuming both are clean and running well, the other thing to expect is that you have to wait a while. If syncing a Group based on Import of a large AD tree, you can actually watch the Group size drop down to zero and then build back up again. For aforementioned tree, it took just under 30 minutes to pull everybody in. That can be a bit of a white knuckle ride, if you don't know if you're going to come out the other side of it cleanly.

           

          Where Tableau is probably hedging their bets with the response you got, is the risk of a "ragged" hierarchy in which the AD tree is not a true tree-subtree but rather has a hodgepodge of overlapping lists. As that is out of Tableau's control, they don't want to promise something to the effect of any arbitrary AD tree will sync fine.  It's fair to say that the smaller and stricter the AD tree's hierarchy, the less hassle you'll have to put up with.

           

          My advice to you is:  make a "dummy" group first, and import the AD tree to that, for testing purposes.   If everything checks out okay, then you can be a lot more confident about doing the same sync to your "production" group(s).

           

          Good luck,

          Ken

          Server8-Cert-PNG-Small.png

          1 of 1 people found this helpful
          • 2. Re: Number of levels an AD import will go down.
            Toby Erkson

            Ken Patton wrote:

             

            ...

             

            Where Tableau is probably hedging their bets with the response you got, is the risk of a "ragged" hierarchy in which the AD tree is not a true tree-subtree but rather has a hodgepodge of overlapping lists. As that is out of Tableau's control, they don't want to promise something to the effect of any arbitrary AD tree will sync fine.  It's fair to say that the smaller and stricter the AD tree's hierarchy, the less hassle you'll have to put up with.

             

            My advice to you is:  make a "dummy" group first, and import the AD tree to that, for testing purposes.   If everything checks out okay, then you can be a lot more confident about doing the same sync to your "production" group(s).

             

             

            I don't want to necessarily pull in 15+ levels, I just want to know if Tableau will so I can plan accordingly.  Tableau support needs to come back with more than a one-line answer if there are caveats.

             

            So your comment is interesting about ragged heirarchies.  Thanks for that, I'll have to look into it but is what you're saying is that a ragged AD tree will not pull in sub-groups?

            • 3. Re: Number of levels an AD import will go down.
              Ken Patton

              My experience has been that it will. My comments were merely to the effect that I can understand why Tableau would not warrant that every AD sync will always work no matter the size and complexity of the AD tree.

              1 of 1 people found this helpful