This section shows example Directory LDAP server query examples. The Active Directory LDAP server configurations are similar except where the object class values, search contexts, and user or group attribute values can be different where:

All group filters can use the search filter syntax described above in the above “Search Filter Syntax” area.

Find all groups that have a prefix “cs_” in their name where “Y” is a group object class for the domain type, and “Z” is a group name attribute:

Example solution:

Note: This method can also be used for finding specific users.

All search context attributes can support looking for LDAP objects in multiple search contexts. Use the “|”character to separate multiple search contexts.

This example is for groups under cn=users and cn=users2 search contexts.

By default the TDV Server is case sensitive when used with either a directory domain, but that can be changed with ldap.properties.

Enable case insensitive user names for LDAP authentication. How can the default case sensitive mode used for LDAP authentication be disabled?

Example solution:

When the LDAP user name comparison is not case sensitive, the user “cn=sam,ou=users,dc=domain,dc=com” can log in to a TDV LDAP domain with user name sam or SAM. All variations of the user name used to log in to TDV tools map to the actual user name stored in the LDAP server.

Note: If you disable case sensitive mode and have multiple users with the same name (but with variations in capitalization) login will be disabled for that user name. You can differentiate users by search context. For instance, in Active Directory, the samaccountname attribute for a user object is globally unique in the LDAP server, but cn (common name) is not.

To start a search from the root node and retrieve all users, use a blank (null) value in the search context.

To find groups that match the objectclass filter, use the following:

To retrieve user names from the user object name attribute:

To perform a search without a timeout:

This search context finds only groups under container ou=people:

This search finds only groups that match the objectclass filter:

This search retrieves group names from this group object name attribute:

To specify a search that does not have a timeout (infinite search timeout):

Using a null value (blank) starts searching from the root node and retrieves all groups:

To find only those groups that match the objectclass filter:

To retrieve group names within this group object name attribute:

To specify a search that does not have a timeout (infinite search timeout):

This search context finds only groups under the container ou=groups:

To find only groups that match the objectclass filter:

To retrieve group names from this group object name attribute:

To specify a search that does not have a timeout (infinite search timeout):

TDV LDAP user authentication dependent on directory servers requires configuration prior to successful user authentication through a TDV interface.

All LDAP users trying to authenticate against an LDAP server need to use the same username attribute value in the both settings below: