Alteryx Server Knowledge Base

miteshnarottam · ‎07-20-2020

Environment Details

Alteryx Server
- Version 2020.1.6+
Integrated Windows Authentication
Integrated Windows Authentication with Kerberos

The Active Directory Groups will still be searchable and selectable but the names appear blank. This makes it hard to know which one is correct. The failure to display any name when a Display Name is empty or whitespace, or when upgrading a gallery with blank Display Name is logged as product defect DE30196.

Cause

You may find certain groups from Active Directory don't appear when attempting to add them under Admin > Users > Groups. One reason could be the Display Name has not been populated by the Server Admin into Active Directory.

How to confirm this (if the group is a security group):

Open File Explorer, navigate to the desktop and right-click on any file or folder, then select Properties.
Select the Security tab then Advanced.
Click on Add, then select Principal Name.
Click on Locations, select Entire Directory and then click OK.
Click Advanced to expand the search criteria.
Enter the name of the group you looking for in the Names textbox, then click on Find Now.
The search results should show the name of the group with a 2 person symbol. (This symbol ensures it's a group and not a user)

Right-click on the Group and select Choose Columns.
Select Display Name from columns available and add this to columns shown, then click OK. Then re-run the search again.
If the Display Name does not show a name this will appear blank when searching for groups in the gallery.

Please Note: In some instances, AD Distribution groups may not show under this view. In such instances please liaise with your AD administrator to confirm if the groups and their attributes exist.

Resolution

Your Active Directory administrator can populate the display name or make sure it is null so that Alteryx will use the "Network" Name as was shown in prior versions.

In newer versions of Server (2020.3+) there is only a single Name field. If the Display Name is null when the AD Group is added to the Gallery, then the "Network" Name will show instead. If the AD Group Display Name is not null, but has no content (for example if it's a space) and had already been added when Alteryx Server is upgraded and the Display Name was not populated, then no name will show at all. There are some steps the Gallery Administrator/Curator can take to correct this once the AD Group has a Display Name or if the Display Name is null.

Pre-work

Important - Please take a backup prior to making any changes. Backup and Restore instruction can be found here
First, it is important to consider whether an AD Group that shows no name imparts Artisan or higher roles to users. If that is the situation, then the replacement steps must be timed carefully if there are schedules that run workflows while making the changes. Searching the Gallery Logs with the keyword "IScheduleOperations" will reveal a 10-minute period between checks that the scheduled workflows have authorization to actually run.
- Click here for instructions on how to find gallery logs
- Open the most recent logs and you will see the following appear every 10mins. During this 10min interval you should make changes.

INFO,25,ActionTrigger<IScheduleOperations>,Work,,,,LD-LT-261,,,,,,"Performing Alteryx.Server.Models.Operations.ScheduleOperations

Completing the replacement within this period will prevent mass disabling of schedules. Note: This process may affect users and schedules so please plan for an outage.

Identifying one more missing display names

If there is no name showing for an AD Group in Gallery, it is still possible to identify them even if there is more than one.

One can use Robo3T or a workflow containing a MongoDB Input tool to see details of the AD groups that are not included in the UI. The collections to look for in MongoDB are under AlteryxGallery database and GroupRoles collection (Click here for instructions on how to connect with Robo3t)
If there is only one "nameless" AD Group that imparts a given role, then that makes it more straightforward. If there are multiple "nameless" AD Groups that impart the same role, then it will be necessary to look at context and match the MongoDB ID to the records
1. Activate Developer tools in the browser of your choice (Most browsers use F12 shortcut for Developer Tools). The images below depict Chrome.
2. Navigate to the Admin > Users page, and click on the Network tab. Select the entry that refers to request header base_address/gallery/api/usergroups/, and click on that to reveal a .json listing of the all groups in the preview tab.
3. Note the Mongo ID numbers that correspond to the affected groups(see examples highlighted above). You can then use these IDs to refer to the exact record in Mongo DB to identify the group you need to remove and re-add.
4. The following screenshot shows the MongoDB ID:60cfb8bbd3a0423ee832f7b and the missing Display name with the windowsidentity and SamAccountName attributes. This information can be used to know which groups to re-add in gallery UI

Keeping in mind the periodic permissions verifications noted above, delete the group that is missing a name, and add the correct group.

Before

After

Additional Resources

Paul_Holden · ‎05-13-2021

Thank you for the article.

Two comments

1. The image is broken for me?

2. On 2020.4 the Search options in Add Group is failing to list all matching groups i.e. I have two AD groups with the same base name but a suffix of _Prod and _Staging. I'm trying to add the _Staging group to our Staging Gallery but only the _Production group appears when I search for {baseADGroupName}

I have confirmed that Display Name is populated.

Can you confirm if the search field matches against DisplayName or SamAccountName or some other field just in case I have a non-printing char or similar issue?