Get and search operations (Active Directory)

Explains how Content Platform Engine performs LDAP searches by various attributes.

Get User or Group by Short Name

Iterate through all forests. For each forest:

  • Connect to GC and search for DN by the short name.
  • Resolve the domain name from the DN.
  • Connect to the domain and search for the user or group by DN.
  • If group membership is asked for, FileNet® P8 searches for it in the local domain first; then searches for it again in the GC. In the end, it combines the results.
  • If the multi-forest support flag is on and the group membership is asked for, FileNet P8 searches for it in all other forests.

If more than one user or group is found, Content Platform Engine will log an error and return the first user found. Content Platform Engine requires that short names be unique across domains and forests.

Get User or Group by DN
  • Resolve the domain name from the DN.
  • Connect to the domain and search for the user or group by DN.
  • If group membership is asked for, FileNet P8 searches for it in the local domain first; then searches for it again in the Global Catalog. In the end, FileNet P8 combines the results.
  • If the multi-forest support flag is turned on and the group membership is asked for, FileNet P8 searches all forests.
Get User by UPN when AllowEmailOrUPNShortNames is disabled
  • Resolve the domain name from the UPN.
  • Get short name from UPN.
  • Connect to the domain and search for the user by short name.
  • If group membership is asked for, FileNet P8 searches for it in the local domain first; then searches again in the Global Catalog. In the end, FileNet P8 combines the results.
  • If the multi-forest support flag is turned on and the group membership is asked for, FileNet P8 will search for it in all other forests.
Get User by UPN when AllowEmailOrUPNShortNames is enabled

Iterate through all forests. For each forest:

  • Connect to GC and search for DN by the UPN.
  • Resolve the domain name from the DN.
  • Connect to the domain and search for the user or group by DN.
  • If group membership is asked for, FileNet P8 searches for it in the local domain first; then searches for it again in the Global Catalog. In the end, it combines the results.
  • If the multi-forest support flag is on and the group membership is asked for, FileNet P8 searches for it in all other forests.

If more than one user is found, Content Platform Engine logs an error and returns the first user found.

Microsoft defines the user principal name (UPN) format to consist of the user name, the at sign (@), and a user principal name suffix. In Content Platform Engine, the user name part is always the short name, and the suffix part is always the DNS domain name of the domain the user belongs to.

Get User or Group by Email Address (AllowEmailOrUPNShortNames on)

Iterate through all forests. For each forest:

  • Connect to GC and search for DN by the email address.
  • Resolve the domain name from the DN.
  • Connect to the domain and search for the user or group by DN.
  • If group membership is asked for, FileNet P8 searches for it in the local domain first; then searches for it again in the Global Catalog. In the end, it combines the results.
  • If the multi-forest support flag is on and the group membership is asked for, FileNet P8 searches for it in all other forests.

If more than one user or group is found, Content Platform Engine logs an error and returns the first user found.

Get User or Group by SID
  • Resolve the domain name from the SID, where the SID can be either the current or historical SID. Part of user and group SID is its domain SID. FileNet P8 maintains a mapping between domain SID and domain name.
  • Connect to the domain and search for the user or group by SID.
  • If group membership is asked for, FileNet P8 searches for it in the local domain first; then searches for it again in the Global Catalog. In the end, FileNet P8 combines the results.
  • If the multi-forest support flag is turned on and the group membership is asked for, FileNet P8 searches all forests.
Search Users or Groups in a Given Realm
  • Connect to the domain specified by the realm name.
  • Search for the users or groups by the search criteria.
  • For each user or group, if group membership is asked for, FileNet P8 searches for it in the local domain first; then searches for it again in the Global Catalog. In the end, FileNet P8 combines the results.
  • If the multi-forest support flag is turned on and the group membership is asked for, FileNet P8 searches all forests.