Attributes not being release from AD

[Douglas E Engert]

The uid attribute can be defined in AD, but requires your windows admins to populate it. It may not be set in your domain.
I don't have access to AD since I retired when we were using IDP 2, but you may want to look at AD using some windows tools such as these:

  https://technet.microsoft.com/en-us/sysinternals/adexplorer.aspx

  https://support.microsoft.com/en-us/kb/224543


Using ldapsearch from unix might also give you some insight into what attributes are in your AD and what your AD admins have done to
keep the data clean. Its also a good way to understand LDAP searching and filters.
For example write some filters to look around for user entries that don't have attributes set as you might expect.


You AD admins may have users located locations other then  CN=users,DC=coastal,DC=edu.
If you have a forest users may be in the forest domains. You did get some referrals, these may be for the sub domains.

with IDP 2 the basic filter we used was:
(&(objectClass=user)(sAMAccountName=$instancePrincipalName.get(0))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

AD has some special filters to look at the bits is userAccountControl, 2 was the account is locked.

  https://support.microsoft.com/en-us/kb/269181

If all the attributes you need are in the Global catalog which is a collections of some attributes from the forest,
you can search the GC.

Work with you AD adminms so you use attributes they maintain.


On 2/11/2016 10:11 PM, Daniel Fisher wrote:
> On Thu, Feb 11, 2016 at 5:03 PM, Michael Richter <mrichter at coastal.edu <mailto:mrichter at coastal.edu>> wrote:
>
>     2016-02-11 16:58:52,577 - DEBUG [org.ldaptive.SearchOperation:168] - execute response=[org.ldaptive.Response at 364560346::result=[org.ldaptive.SearchResult at 4303153::entries=[], references=[]],
>     resultCode=SUCCESS, message=null, matchedDn=null, responseControls=null, referralURLs=[ldap://DomainDnsZones.coastal.edu/DC=DomainDnsZones,DC=coastal,DC=edu
>     <http://DomainDnsZones.coastal.edu/DC=DomainDnsZones,DC=coastal,DC=edu>, ldap://ForestDnsZones.coastal.edu/DC=ForestDnsZones,DC=coastal,DC=edu
>     <http://ForestDnsZones.coastal.edu/DC=ForestDnsZones,DC=coastal,DC=edu>, ldap://coastal.edu/CN=Configuration,DC=coastal,DC=edu <http://coastal.edu/CN=Configuration,DC=coastal,DC=edu>], messageId=-1]
>
>
> Your search produced no entries, but you did get some referrals.
>
>     for request=[org.ldaptive.SearchRequest at 1651751780::baseDn=DC=coastal, DC=edu, searchFilter=[org.ldaptive.SearchFilter at 311971475::filter=(uid=mrichter),
>
>
> Confirm that baseDn and search filter are correct. Doesn't active directory store users under a branch like CN=users,DC=coastal,DC=edu?
>
> --Daniel Fisher
>
>
>

-- 

  Douglas E. Engert  <DEEngert at gmail.com>