LDAP Filter Condition

[Suresh61]

Hi,

I want to build LDAP Server filter condition based on an RDN and Filter condition from multiple OUs using only one filter condition. I tried RDN: OU=User Accounts,DC=abc,DC=xyz,DC=org and filter: (&(objectClass=user)(objectCategory=person))
OU 1: OU=Administration,OU=abcd,OU=User Accounts,DC=abc,DC=xyz,DC=org
OU 2: OU=Facilities,OU=Non abcd,OU=User Accounts,DC=abc,DC=xyz,DC=org
OU 3: OU=Partners,OU=User Accounts,DC=abc,DC=xyz,DC=org

Please suggest one LDAP filter for getting all users from the above OUs. Thank you in advance!!

[Abhishek Pal]

Hi Suresh61,

If all three OUs are located under the same parent OU, you can configure the LDAP OU Definition at the common parent level instead of trying to combine the OU paths in the LDAP filter.

For example, if the LDAP Server Starting Search Directory is:

DC=abc,DC=xyz,DC=org

Configure the RDN as:

OU=User Accounts

Then use the user filter:

(&(objectClass=user)(objectCategory=person))

This will search beneath:

OU=User Accounts,DC=abc,DC=xyz,DC=org

and can include users from child OUs such as:

OU=Admin,OU=User Accounts,DC=abc,DC=xyz,DC=org

OU=Facilities,OU=Non abcd,OU=User Accounts,DC=abc,DC=xyz,DC=org

OU=Partners,OU=User Accounts,DC=abc,DC=xyz,DC=org

Recommended approach:

1. Use the common parent OU if you want users from all child OUs below User Accounts.

2. Keep the LDAP filter focused on identifying users:

(&(objectClass=user)(objectCategory=person))

3. If User Accounts contains additional OUs that should not be imported, create separate LDAP OU Definitions for the required branches instead.

For example:

OU=Admin,OU=User Accounts

OU=Facilities,OU=Non abcd,OU=User Accounts

OU=Partners,OU=User Accounts

You can use the same user filter on each OU Definition.

This is cleaner and more maintainable than trying to combine multiple distinguished OU paths into one LDAP filter.

Things to verify:

- Confirm the LDAP Server Starting Search Directory.
- Use Browse on the LDAP OU Definition to confirm which users are returned.
- Check whether other unwanted OUs exist below User Accounts.
- Test the OU Definition before running the scheduled LDAP import.

Hope this helps!

If this response helped, please mark it as Helpful.
If it resolves your issue, please Accept it as Solution.

Kind Regards,
Abhishek Pal

[Suresh61]

I tried this solution, but I'm not getting any users when I click on the LDAP nodes. Please suggest a different solution. Thanks!!

[Abhishek Pal]

Hi @Suresh61 ,

Thanks for testing it.

Since the common parent OU is not returning users in your environment, I would use separate LDAP OU Definitions instead of trying to combine the three directory paths into one filter.

An LDAP filter controls which records are returned from a search location. It does not provide multiple independent search bases.

Assuming the LDAP Server Starting Search Directory is:

DC=abc,DC=xyz,DC=org

Create three LDAP OU Definitions:

OU Definition 1

RDN:
OU=Admin,OU=User Accounts

Filter:
(&(objectClass=user)(objectCategory=person))

OU Definition 2

RDN:
OU=Facilities,OU=Non abcd,OU=User Accounts

Filter:
(&(objectClass=user)(objectCategory=person))

OU Definition 3

RDN:
OU=Partners,OU=User Accounts

Filter:
(&(objectClass=user)(objectCategory=person))

Important:

Do not include:

DC=abc,DC=xyz,DC=org

again in the OU Definition RDN if it is already configured as the LDAP Server Starting Search Directory.

ServiceNow combines the OU Definition RDN with the Starting Search Directory.

After creating each definition, use the Browse related link and verify that users are returned.

If Browse still returns no users, temporarily test with:

(objectClass=user)

If that also returns nothing, the issue is most likely the RDN/search location rather than the filter.

Also verify:

1. LDAP Server connection is successful.
2. Starting Search Directory is DC=abc,DC=xyz,DC=org.
3. The LDAP service account has read access to all three OUs.
4. The OU names and hierarchy exactly match Active Directory.
5. Browse works individually for each OU.

You can point the three LDAP Data Sources to the same Import Set table and reuse the same Transform Map, so you do not need three separate transformation implementations.

For this requirement, multiple OU Definitions under the same LDAP Server is the cleaner and more reliable approach.

Hope this helps!

If this response helped, please mark it as Helpful.
If it resolves your issue, please Accept it as Solution.

Kind Regards,
Abhishek Pal

[Suresh61]

Thanks for your response. But I'm still facing struggles with building LDAP filter condition based on multiple parent OUs. Below is the example of OUs structure. For this multiple parent OUs, I used 'Starting Search Directory' as 'DC=xyz, DC=org' , 'RDN' as 'OU=User Accounts,DC=abc' and 'filter' as '(&(objectClass=user)(objectCategory=person))'

Parent OU1:
OU 1: OU=Administration,OU=abcd,OU=User Accounts,DC=abc,DC=xyz,DC=org
OU 2: OU=Support,OU=abcd,OU=User Accounts,DC=abc,DC=xyz,DC=org
OU 3: OU=Fellows,OU=abcd,OU=User Accounts,DC=abc,DC=xyz,DC=org
OU 4: OU=Residents,OU=abcd,OU=User Accounts,DC=abc,DC=xyz,DC=org

Parent OU2:
OU 1: OU=Facilities,OU=Non abcd,OU=User Accounts,DC=abc,DC=xyz,DC=org
OU 2: OU=Corporate,OU=Non abcd,OU=User Accounts,DC=abc,DC=xyz,DC=org
OU 3: OU=Finance,OU=Non abcd,OU=User Accounts,DC=abc,DC=xyz,DC=org

Parent OU3:
OU 1: OU=Partners,OU=User Accounts,DC=abc,DC=xyz,DC=org
OU 2: OU=Badge only,OU=User Accounts,DC=abc,DC=xyz,DC=org

The main issue here is I tried building one RDN and filter for Parent OU1 to fetch users, but the LDAP Node is not connecting to AD. Please suggest a LDAP filter for each parent OUs. 

Thank you so much in advance