Fetching Specific User Attributes from an LDAP Server

If your TOS users are stored on an LDAP server (for example, Microsoft Active Directory) TOS sends an API query to retrieve the LDAP record attributes required for users to connect to the system, such as user name and e-mail address.

TOS requests all attributes for each LDAP record from the LDAP server. After receiving the information, TOS extracts the specific attributes that are required.

This works for most LDAP vendors. However, recently it was discovered that OpenDJ LDAP servers do not return operational attributes. With OpenDJ you need to request specific LDAP attributes. If all attributes are requested, OpenDJ will only return user attributes, but not operational.

For example EntryUUID, a non-editable operational attribute, which is usually mapped to uniqueIdAttributeName.

Therefore from R22-1 PGA, you can activate a new flag in the API query to requests the specific attributes needed by TOS.

Currently only relevant for OpenDJ servers.

Fetch specific user attributes from an LDAP server

• Configure the custom LDAP configuration as follows:

INSERT INTO ldap_attr (vendor, attr_objective, attr_name, attr_type) VALUES ('OpenDJ', 'isSupportFetchBySpecificAttributes' , 'true' , 'string')

To disable the behavior:

delete from ldap_attr where attr_objective = 'isSupportFetchBySpecificAttributes';