TDI LDAP adapter - modify search filter to exclude certain groups   

Hi I have a requirement to modify the out of box TDI LDAP adapter. We want to exclude any groups that have objectclass=ibm-nestedGroup and the user account membership returned in the recon by user from the nested group. Has anyone done that before? Thank you!

Hi YN, The out of box does process nested groups. I just ran a recon with the out of box adapter, it brought back all the nested groups. Thanks!!

In this LDAP enviornment, no memebers should be assigned directly to any NESTED groups. To be a part of the NESTED GROUP, memeber needs to be a part of the UN-NESTED GROUP that is part of the NESTED GROUP.

For example:

NESTED GROUP A

---

UN-NESTED GROUP B (MEMBER A)

This way MEMBER A is a part of GROUP B, and also GROUP A.

In ITIM, we expect the recon will bring back GROUP B but not GROUP A... and also MEMBER A. Under MEMBER A's account we only expect to see UN-NESTED GROUP B (but NOT NESTED GROUP A).

Further more, if a person were incorrectly placed into a nested group - ITIM recon will need to remove the user out of the nested group based on the fact the provisioning policy does not connect to GROUP A.

Do you think this is doable? Thank you so much for your time!!

Hi YN, thanks for helping...

Since we already have another custom LDAP adapter, my boss was actually thinking not to make another custom ldap adapter, otherwise there will be three different LDAP adapters. so I was thinking to make the modification in the out of box ldap and was hoping we can still use it for the other regular LDAP environments. But after reading your answer, I feel this is not possible. so I will have to make another custom LDAP specifically for this LDAP enviornment.

I like your idea of having the new objectclass for unnested groups... but dont know if the business will want to do that. will check with them anyway...

if i will have to go down the path to perform data manipulation in the tdi scripts to ingnore objectclass=ibm-nestedGroup, how do I do this? I can do this in BeforeGetNext hook.

My other question is, can I do this i the filter: so the recon will bring in the unnested groups? thanks -
(&(objectclass=groupofuniquenames)(!(objectclass=ibm-nestedGroup)))

Hi YN, Thank you so much for helping.

I am able to bring in just the UN-NESTED groups now :-) This is what I did in the LDAPSearch AL's prolog. In the section for "group iterator connector and initialize", I had to change gConnConfig.setParameter

FROM:
gConnConfig.setParameter(
Packages.com.ibm.di.utils.LDAPAdapterUtils.LDAP_SEARCH_FILTER,
"(" + Packages.com.ibm.di.utils.LDAPAdapterUtils.OBJECTCLASS + "=" + gGrpObjectClass + ")");

TO:
gConnConfig.setParameter(
Packages.com.ibm.di.utils.LDAPAdapterUtils.LDAP_SEARCH_FILTER,
"(&(objectclass=groupofuniquenames)(!(objectclass=ibm-nestedGroup)))");

However I am having problem bring any users... I didnt apply your second suggestion, because I was just told that we want to bring in all accounts regardless its in a nested or un-nested group. This is the warning message I am getting from ITIM recon:
CTGIMD014I 37 reconciliation entries were not processed for the following accounts: eruid=null; eruid=null; eruid=null;........

I am still trying to figure out what goes wrong with bringing the users, and they all have valid userid not NULL..

Thank you so much for your help and have a great weekend!

Lori

Hi YN,

I didn't have to include the second seggestion for group memebership. The recon is excluding the nested group, but ITIM needs to know when an user is in a nested group. I was able to get the adapter working by just adding the filer on the out of box adapter. Thank you so much!