Multiple OUs issues

[Former Member]

Hi,

We have a query,

1.We are using multiple OUs for LDAP server.

2.We have mapped a group in LDAP authentication but in that group all the users are coming from different OUs. We are unable to see the users which are in the different OUs,if we configure the LDAP using a Administration DN from the one of the OU.

We gave the "LDAP server administrator distinguished name " in one of the OU then only that OU users are able to log into the infoview using LDAP authentication and incase we gave "LDAP server administrator distinguished name " in base domain then all the users are able to login to the infoview using LDAP authentication.

So wants to know any work around for give the "LDAP server administrator distinguished name " in one of the OU .

Any one please help on this issue.

Thank You in Advance.

Thanks & Regards,

Bill.

[jmsrpp · Accepted solution]

Hi,

It sounds like you might be specifying too granular an LDAP Base Distinguished Name to me. Let's look at an example:

Groups

cn=support, ou=customer assurance, o=sap

cn=sales, ou=sales, o=sap

LDAP Plugin Properties

Base LDAP Distinguished Name = ou=customer assurance, o=sap

LDAP server administrator distinguished name = cn=jrapp, ou=customer assurance, o=sap

Since we map in the groups by their full Distinguished Name, and the user 'jrapp' has permissions to query the root of the LDAP server, both groups and users are created successfully. However, because the Base DN is set at ou=customer assurance, o=sap instead of o=sap, users from the OU 'sales' will need to log in using their complete DN (i.e. cn=bmathew, ou=sales, o=sap).

Try having a user who is in the 2nd OU log in with the complete DN for their user account. If that works, you'll know that you need to do 1 of 2 things:

1. Set the base DN to a less granular level (o=sap instead of ou=customer assurance, o=sap)

2. The user you have specified for the Administrator DN does not have appropriate permissions to query the 2nd OU

Feel free to provide the exact entries as they appear on your LDAP tab if this doesn't prove to solve the problem.

Thanks,

Jim