LDAP sync with Sun

t-itou

Hi all,

I'm planning to use Sun One Directory Server 6.3 with D6.5 for synchronizing users with LDAPSync job.

I found the sentence in CS Admin guide.

If you are using iPlanet, you must enable the changelog feature to use the inactivation operation.

Also Sun says that change log is not accessible over LDAP in this version. If it need to read it, use the

retro change log plug-in.

So I'm not sure if it need to get plug-In to enable to access changelog.

Does anyone knows?

Regards

Find more posts tagged with

Documentum

Comments

Chaithanya

Hi,

The change log functionality is required to automatically deactivate users in documentum repository, when the users have been deleted from the LDAP server (When the LDAP config object has been created with the option of automatically deactivating users, when the user entry is deleted from directory server). If you dont need this functionality you can go ahead with the directory server installation with out that plugin, so you may need to manually deactivate or delete users when the users entries have been removed from the directory server.

t-itou

Thank you for this information.

To make sure more clearly, let me ask more detail.

I understand it's needed to deactivate users automatically when users delete from LDAP.

But how about user modification action.

Without plugin installation, when users are moved from division A to division B in LDAP,

do I need to change them manually?

Chaithanya

If you are using sun one directory server, then the uniqueness goes by nsuniqueid attribute, so changelog will be used only during if user deactivation is required in such case.If you have moved user from one department to other, and the other department(which is not in the scope of user search base) and such user needs to be deactivated, you may need changelog.

Thanks

Chaithanya

t-itou

Thank you Chaithanya.

I installed Sun Java Directory Server 6.3 and tried to import users from LDAP using LDAPSync job.

It seems fine with first full import action and second import action after user modification.

After deletion the user at LDAP server, the user was not inactivate with the job.

Job report says that finished deactivation users.

2009-12-15 14:18:02 JST: Processing Deactivated Users...
2009-12-15 14:18:02 JST: LDAP Search: search base >>>cn=changelog<<<
2009-12-15 14:18:02 JST: LDAP Search: search filter >>>(&(changetype=delete)(changenumber>=2))<<<
2009-12-15 14:18:02 JST: LDAP Search: search scope >>>1<<<
2009-12-15 14:18:02 JST: Finished processing Deactivated Users
2009-12-15 14:18:02 JST: User synchronization finished.

It seems Sync job found the delete user info from changelog in LDAP and launched deactivate action.

but the user is still active state.

I really appreciate your help.

Regards

Chaithanya

Hi ,

Looks like the search on change log is not returning any users, so none of the users were deactivated in the repo. Also check if the "deactivate deleted users" option has been selected on sync & authentication tab of LDAP configuration in DA. Make sure that the changelog has entries regarding deleted users.