topic Base entry in Application Development and Automation Discussions

Base entry

Former Member — Fri, 02 Mar 2007 08:56:01 GMT

Hi,

Does anyone know how to synchronize the users in active directory, which belong to admin group to SAP R/3 where the users are in different "ou". When I try to synchronize, I can only filter by "ou" using the base entry.

Can I filter by anything other than "ou"?

Thanks

Re: Base entry

Andre_Fischer — Sun, 04 Mar 2007 21:12:36 GMT

Hi Brian,

I am not sure whether I got your question correctly. You will find all users in the Active Directory if you use the root entry of the DIT (Directory Information Tree) as your root entry. You can use a simple Visual Basic script that I just posted.

How to get the 'Base entry' for an LDAP connector from Active Directory?

What do you mean by "I can only filter by "ou" using the base entry" ?

Best regards,

André

Re: Base entry

Andre_Fischer — Sun, 04 Mar 2007 21:21:27 GMT

Hi Brian,

the filtering is actually done by the attribute that is defined as the filter attribute in transaction LDAP.

If you choose an appropriate attribute you can assign values to this attribute only to a certain group of users.

As a result you may use the root entry as the base entry because the LDAP search will only synchronize those users having set the attribute that is defined in your LDAP mapping.

Best regards,

Andre

Re: Base entry

Former Member — Tue, 06 Mar 2007 02:42:19 GMT

Thanks Andre,

We have used your advice and configured for testing. We've managed to sync the users and using one of the fields in the active directory to sync the SAP roles.

The only item is that in the program RSLDAPSYNC_USER where selection of users to be synchronized, we are now trying to filter this by the organization unit (ou).

Wondering if you have come across the filtering within RSLDAPSYNC_USER that enables us to configure in active directory by group members and sync this group of users.

Thanks for the advice. Rgds, Brian

Re: Base entry

Andre_Fischer — Thu, 08 Mar 2007 23:06:41 GMT

Hi Brian,

you could write a visual basic script that selects members of a specific group and that sets a users attribute (for example sapUsername or extenstionattribute1).

You could use the following script as a starting point that I have posted as a Wiki.

Best regards,

André

Re: Base entry

Andre_Fischer — Fri, 09 Mar 2007 11:33:33 GMT

I have updated the script.

Best regards,

Andre

Re: Base entry

Former Member — Thu, 07 May 2009 04:43:38 GMT

Hello Andre,

I was wondering if you could elaborate on this answer and perhaps give an example of how the specify the filtering based on an AD attribute (I assume this is done in transaction LDAPMAP).

"the filtering is actually done by the attribute that is defined as the filter attribute in transaction LDAP.

If you choose an appropriate attribute you can assign values to this attribute only to a certain group of users.

As a result you may use the root entry as the base entry because the LDAP search will only synchronize those users having set the attribute that is defined in your LDAP mapping."

Thanks a lot

Carlos

Re: Base entry

Andre_Fischer — Fri, 08 May 2009 11:09:29 GMT

Hi Carlos,

please see "Figure 6 - Mapping of SAP data fields to directory attributes" in my whitepaper I[ Integration of SAP central user administration with Microsoft Active Directory|https://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/8302a929-0501-0010-05b5-d48f544bc572].

Best regards,

André

Re: Base entry

Former Member — Fri, 08 May 2009 13:03:28 GMT

Thanks, Andre. I'll check it out.

Carlos