How to re-sync an LDAP OU definition

David Morden · ‎05-17-2017

I am trying to find out the best practice for wiping out an LDAP import (in my case groups), and then re-importing that OU definition. In my scenario, the Groups OU previously had the wrong filter set, and now that it's been corrected, the invalid data is still in the sys_user_groups table.

What is the best method to clear the sys_user_groups table and force LDAP to perform the Groups OU definition import from scratch?

On a related question, what is the best method for using LDAP to manage group members? For example, when a user is added or removed from a group/OU in AD, we want the same to happen in SN as part of the LDAP integration.

benc · ‎05-17-2017

As a general rule with transform map imports (which is what the LDAP imports are), deleting the target records and re-running the sync will cause the records to be re-created. In other words, the steps would look like:

Delete all of the invalid sys_user_groups - you can do this by either the list view or, if you imported hundreds or thousands of groups by accident, in a script with deleteMultiple();
Re-load data from your LDAP source (System LDAP -> Data Sources -> Your Data Source -> Load All Records)
After you click Load All Records and it finishes loading records into your import source table, the status screen will have a "Transform" related link at the bottom, click on it.
On the transform map select screen, make sure that your LDAP transform map is selected (make sure that it's in the box on the right).
Click Transform. This will cause the imported groups to be transformed into ServiceNow groups.

In our environment, we manage group membership via LDAP. We have a scheduled load (System LDAP -> Scheduled Loads) that pulls in changes from our AD every four hours. We import both users and groups from LDAP, so we have two scheduled loads: one for users and one for groups. We have the scheduled load for user import set to run on a schedule, and the group import scheduled load is set to "After Parent Runs," with the user transform as the parent. This way, all changes to users are imported and then changes to groups and group membership are updated immediately after. Importing a group automatically imports the membership (though it won't do anything if it can't match any of the members of the LDAP group to ServiceNow user records).

View solution in original post

benc · ‎05-17-2017

As a general rule with transform map imports (which is what the LDAP imports are), deleting the target records and re-running the sync will cause the records to be re-created. In other words, the steps would look like:

Delete all of the invalid sys_user_groups - you can do this by either the list view or, if you imported hundreds or thousands of groups by accident, in a script with deleteMultiple();
Re-load data from your LDAP source (System LDAP -> Data Sources -> Your Data Source -> Load All Records)
After you click Load All Records and it finishes loading records into your import source table, the status screen will have a "Transform" related link at the bottom, click on it.
On the transform map select screen, make sure that your LDAP transform map is selected (make sure that it's in the box on the right).
Click Transform. This will cause the imported groups to be transformed into ServiceNow groups.

In our environment, we manage group membership via LDAP. We have a scheduled load (System LDAP -> Scheduled Loads) that pulls in changes from our AD every four hours. We import both users and groups from LDAP, so we have two scheduled loads: one for users and one for groups. We have the scheduled load for user import set to run on a schedule, and the group import scheduled load is set to "After Parent Runs," with the user transform as the parent. This way, all changes to users are imported and then changes to groups and group membership are updated immediately after. Importing a group automatically imports the membership (though it won't do anything if it can't match any of the members of the LDAP group to ServiceNow user records).

David Morden · ‎05-18-2017

I tried following the steps exactly as outlined, and now no updates for groups are coming across during the adhoc or scheduled LDAP syncs (4 groups added in AD this morning that are now not syncing). Is there a way to reset or start the LDAP process over from scratch?

David Morden · ‎05-18-2017

Got this issue resolved by copying filter from different default dev instance.