topic Jabber AD LDAP Filtering Question.... in Collaboration Applications

Jabber AD LDAP Filtering Question....

VLT06 — Sun, 17 Mar 2019 21:45:14 GMT

Hi Guys,

Has anyone faced the issue or come up with a solution regarding the LDAP to AD for user search for people that have more then one account….

Example would be that Bob Down has two accounts in AD 1 for normal day to day user & second one for administrator that he only uses once in a while. When doing a look up in jabber, he appears twice.

Is there any way to intervene to filter the search to only lookup normal user accounts and not pull administrator/test accounts???

Jabber AD LDAP Filtering Question....

Jonathan Schulenberg — Mon, 05 Nov 2012 04:49:51 GMT

There are probably dozens of ways to get this done.

Here's my default; it filters the results to only non-disabled accounts. This is also the CUCM default filter if you don't define a Custom LDAP Filter.

(&(objectCategory=person)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))

You could change it to be this which also excludes any accounts that have the phrase ADMIN in their surname (aka Last Name) attribute.

(&(objectCategory=person)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))(!(sn=*ADMIN*)))

Another option would be to rule out anyone with Domain Admin group memberhsip:

(&(objectCategory=person)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))(!(memberOf=CN=Domain Admins,CN=Users,DC=domain,DC=com)))

Yet another would be to rule out anyone with "admin" in their username (aka sAMAccountName):

(&(objectCategory=person)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))(!(sAMAccountName=*admin*)))

Please remember to rate helpful responses and identify helpful or correct answers.

Jabber AD LDAP Filtering Question....

VLT06 — Mon, 05 Nov 2012 21:05:23 GMT

Wow, excellent stuff!

So this filter would be in the CUPS Ldap filter yeah?

Jabber AD LDAP Filtering Question....

Jonathan Schulenberg — Mon, 05 Nov 2012 21:20:32 GMT

For CUPC clients yes. For Jabber you would need to place it in the jabber-config.xml file.

Please remember to rate helpful responses and identify helpful or correct answers.

Jabber AD LDAP Filtering Question....

VLT06 — Mon, 05 Nov 2012 22:11:12 GMT

What can I say.... Champion!

Cheers!

Jabber AD LDAP Filtering Question....

VLT06 — Wed, 07 Nov 2012 20:34:24 GMT

Hmmmmmm.... Ok......

Is there any reason that this would work for client 9.1.0 and not 9.0.1?

Basically, adding any "Base Filter" to 9.1.0 works perfectly, but 9.0.1 looses all visibility of the directory all together???

I an add "" and it is fine, however as soon as I populate between the fields, 9.0.1 does not like it where 9.1.0 works a treat????

Jabber AD LDAP Filtering Question....

Jonathan Schulenberg — Wed, 07 Nov 2012 22:06:59 GMT

Two things to try:

Remove the last ')'
Change '&' to '&'

Please remember to rate helpful responses and identify helpful or correct answers.

Jabber AD LDAP Filtering Question....

VLT06 — Mon, 12 Nov 2012 20:05:59 GMT

Yep, removing the last ")" did the job!

As I said before, Champion!

Cheers!

Jabber AD LDAP Filtering Question....

Mark Turpin — Fri, 29 Mar 2013 15:52:25 GMT

This thread helped me so I wanted to post a working example -

IMP 9.1

Jabber 9.1 / 9.2

(&(objectCategory=person)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))

--
-Mark Turpin

Hi,I have a scenario where

Prasanth C.R. — Mon, 04 Aug 2014 15:12:54 GMT

Hi,

I have a scenario where multiple customer's users use same CUCM and the users should not list users from other OU's.

For example, we have OU's ent1, ent2 and ent3 in domain cisco.com

user1@ent1.cisco.com, user2@ent1.cisco.com

user3@ent2.cisco.com, user4@ent2.cisco.com

user5@ent3.cisco.com, user6@ent3.cisco.com

I configured the jabber-config.xml file to omit the users from ent2 OU alone using below configuration.

<Directory>
<DirectoryServerType>EDI</DirectoryServerType>
<ConnectionType>1</ConnectionType>
<PrimaryServerName>10.4.252.25</PrimaryServerName>
<UseWindowsCredentials>0</UseWindowsCredentials>
<UseSecureConnection>1</UseSecureConnection>
<SearchBase1>ou=ENT1,ou=master,dc=sharedAD,dc=com</SearchBase1>
<UserAccountName>uid</UserAccountName>
<BaseFilter>(&(objectCategory=person)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))(!(mail=*ent2*)))</BaseFilter>
<PredictiveSearchFilter>uid</PredictiveSearchFilter>
</Directory>

Can someone give pointers how to modify this xml file to filter users from its own OU

- Prasanth R

Re: Jabber AD LDAP Filtering Question....

Yarin Ezra — Tue, 22 Nov 2022 13:27:48 GMT

Hey jonathan,

what would you need to put in the Jabber Config file in-order for the filter of disabled ldap account no to pop up in jabber search

Re: Jabber AD LDAP Filtering Question....

Roger Kallberg — Wed, 23 Nov 2022 18:31:43 GMT

That is outlined in the CM feature documentation as it is part of the default LDAP filter that is implicitly used if no custom filter is used.

Re: Jabber AD LDAP Filtering Question....

Roger Kallberg — Sun, 27 Nov 2022 07:33:33 GMT

Disabled user can be omitted by this highlighted part. This particular filter is the default filter used in CM for the LDAP synchronisation if no custom filter is used.

Standard default LDAP filter for users
(&(objectclass=user)(!(objectclass=Computer))(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))

Re: Jabber AD LDAP Filtering Question....

Yarin Ezra — Sun, 27 Nov 2022 06:47:01 GMT

I've tried a lot of solutions last week and they all gave me the same result, after adding the filter to the service profile of the End Users, disabled user were no longer shown as well as their active users.

Say Bob has an active user and a disabled user, both users were gone after the filter, all the other active users were shown correctly.

We ended up syncing jabber with UDS and that's what gave the best result for the client.

Re: Jabber AD LDAP Filtering Question....

Roger Kallberg — Sun, 27 Nov 2022 07:35:56 GMT

If possible could you please share the filter that you used and a screenshot of the where you applied it?

Re: Jabber AD LDAP Filtering Question....

Yarin Ezra — Sun, 27 Nov 2022 08:06:30 GMT

I've applied the filter to the Service Profile (UserManagement > User Profile > Service Profile) (Screenshot Included):

(!userAccountControl:1.2.840.113556.1.4.803:=2) - similar to what you sent the latest without the objectclass

(!userAccountControl=514)

and some more which i cant find.

Re: Jabber AD LDAP Filtering Question....

Roger Kallberg — Mon, 28 Nov 2022 11:37:58 GMT

This is the settings we use for this.

The filter is set as per what I answered in my previous reply.

Re: Jabber AD LDAP Filtering Question....

Yarin Ezra — Mon, 28 Nov 2022 11:40:02 GMT

Amazing thank you !