Exclude using LDAP filter for active directory source

Identity Security Cloud (ISC) ISC Discussion and Questions
, , ,
1

Hello,
Currently, we have a use case where we have a user account in active directory on premise and would like to be excluded from pulled into sailpoint.

His DN is CN=EX123,OU=Design,OU=Employees,DC=Company,DC=com

Our current user search scope in sailpoint active directory ldap filter is:
(&(objectCategory=person)(objectClass=user))

Search dn: DC=Company,DC=Com

I would like to be able exclude this user from being pulled into sailpoint or the OU/folder itself.

I read some documentation here - Account and Group Settings

and

What would be the best way to do this?

Thank you.

2

try the following:

(&
  (objectCategory=person)
  (objectClass=user)
  (!distinguishedName:dn:=OU=Design,OU=Employees,DC=Company,DC=com)
)
3

I adjusted the parenthesis because it was giving errors due to it

(&
  (objectCategory=person)
  (objectClass=user)
  (!(distinguishedName:dn:=OU=Design,OU=Employees,DC=Company,DC=com))
)

After adjusting, errors went away but it did not exlude ou=design folder after account aggregation.

4

rather than the OU, specify the full dn of the user.

5

We will have more users like this. I was looking to see if I can put them in an exclusion folder rather than updating ldap filter each time.

6

Having the same kind of issue. I’m trying to exclude an OU during aggregation the KAs and LDAP filters suggest not using DN wildcards for exception OU. Any advice here would be great.

7

try putting a wild card for the container context with the “*” included

(!distinguishedName:dn:=*OU=Design,OU=Employees,DC=Company,DC=com)

8

I did that too. Odd, it didn’t work.

(&(objectCategory=person)(objectClass=user)(!(distinguishedName:dn:=*OU=Design,OU=Employees,DC=Company,DC=com)))
9

Tthis worked.

(&(objectClass=User)(objectcategory=person)(!(|(msDS-parentdistname=OU=Design,OU=Employees,DC=company,DC=com))))

10

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.