Skip to Content

HR sync to LDAP - specify destination OU?

Hi all,

<b>Note</b>: We are not using NetWeaver IdM on my project, so the following refers only to tools available in NetWeaver ABAP+Java 7.0. The HR - LDAP sync I talk about has been around since R/3 4.7.

I am configuring a scenario to synchronise employees from HR to LDAP (Active Directory in this case). The company's AD instance has several top-level OUs containing users, and I want new users to be created in another top-level OU (e.g. OU=NewUsers,dc=company,dc=com).

As standard in transaction LDAP, I can specify the LDAP server to use OU=NewUsers, but then existing users only get synchronised if they are underneath OU=NewUsers (i.e. users in other top-level OUs fdo not get synced).

I need existing users to be synchronised if they exist anywhere in the directory, and currently the only way to do this is to specify the LDAP server as dc=company,dc=com, which means that all new users get put in the top of the directory tree instead of in OU=NewUsers.

Can anyone tell me how to set up HR-LDAP sync so that new users get put in OU=NewUsers but all users in other OUs still get synced?

Best regards,

Darren

Add a comment
10|10000 characters needed characters exceeded

Assigned Tags

Related questions

2 Answers

  • Posted on Oct 25, 2007 at 10:41 AM

    Are you moving entries from "OU=NewUsers,dc=company,dc=com" to other locations in the directory? Well, then it will be difficoult to sync. these entries avter you have moved them.

    If HR knows the location of every entry in the directory, that means HR knows the complete dn of every employee, then you can try to set up several LDAP sync jobs with different selection of the employees. These jobs are using different LDAP servers pointing to different base entries.

    Kind regards

    Frank Buchholz

    Add a comment
    10|10000 characters needed characters exceeded

    • Interesting idea - I like the thinking. Since we are pulling users back from AD into CUA and then linking them to employees, the list of "new employees" is essentially the list of employees that do not have infotype 0105 populated, so we could use that to drive the creation job...

      I will try this out next week and let you know how we did - thanks for the inspiration.

      Cheers,

      Darren

      P.S. Could you feed back to the development team that adding a "CREATION_DN" parameter to SPLDAP_RECEIVE_ATTRIBUTES would be a really nice idea? This parameter would specify the DN in which to create new users.

  • Posted on Nov 12, 2015 at 04:39 PM

    Darren,

    8 years later, did you managed to get what you needed?

    Add a comment
    10|10000 characters needed characters exceeded

Before answering

You should only submit an answer when you are proposing a solution to the poster's problem. If you want the poster to clarify the question or provide more information, please leave a comment instead, requesting additional details. When answering, please include specifics, such as step-by-step instructions, context for the solution, and links to useful resources. Also, please make sure that you answer complies with our Rules of Engagement.
You must be Logged in to submit an answer.

Up to 10 attachments (including images) can be used with a maximum of 1.0 MB each and 10.5 MB total.