LDAP Groups are empty

Hello Forum,
I have a teaming 2.1 installation up and running and it synchronizes well with the ldap-server except for one thing: All groups are empty. users are synced and operable, groups are also there but empty.
I'm not sure how to have teaming extract the group members.
Any thoughts?
TIA,
MKramer

Originally Posted by ksiddiqui
Kramer,
Is there are reason why you use posixgroup and not the default filter which is:
(|(objectClass=group)(objectClass=groupOfNames)(ob jectClass=groupOfUniqueNames))
-- Khurram
Yes, our directory tree does not have the objectClass group. Groupnames are have the objectClass posixgroup. Groupmembers have the attribute memberUid.
the default filter cannot (at least does not) extract any data from our tree.
The box syncronize group membership is checked and I suspect that teaming tries to extract the group members via a different attribute than memberUid. Unfortunately I have not found information about how specifically the group member sync takes place.
Thanks in advance,
M. Kramer

Similar Messages

LDAP Group is empty while the LDAP group have 150 users

Hi,
My BOE is mapped to the corporate LDAP, and the LDAP group is already mapped to a BO group.
The problem is that the LDAP Group is empty while the LDAP group have 150 users.
Currently, just after each user login at the first time the user is created under the BO Group.
Is there any way to populate the BO Group automatically?
Best Regards,
DoronS

Hi,
yes there is. Check your LDAP Authentication Tab and select "Create new aliases when the Alias Update occurs"
It should be under your Alias settings.
But please note that you than require 150 licenses. So each users gets a license even if he doesnt use the BOE System but is part of the LDAP Group.
Regards
-Seb.

After restoring contacts from time machine, all groups are empty

I had to restore a backup of my address book folder from time machine. Library/Application Support/Address Book, I also removed deleted the com.apple.addressbook.plist files. When I open address book, all the contacts and group names show, but the groups are now empty when I click on them. Any thoughts?

Quit Contacts or Address Book if it’s running. If you use iCloud, uncheck the box marked Contacts in the iCloud preference pane.
Triple-click the text on the line below to select it, then copy it to the Clipboard (command-C):
~/Library/Application Support/AddressBook/Metadata
In the Finder, select
Go ▹ Go to Folder
from the menu bar, paste into the box that opens (command-V), and press return.
A Finder window will open with a folder selected. Move the selected folder to the Desktop, leaving the window open for now.
Relaunch the application and test. If there’s no improvement, quit and put back the item you moved, overwriting the newer one that may have been created in its place. Otherwise, delete the item.

URL logon groups are empty in SMMS

hello,
i'm trying to configure http load balancing with message server.
i've created a logon group and assigned it to url webgui in SICF
it seems to work but in sape note 751873 it is said that logon groups and corresponding urls could be loaded and checked in transaction SMMS using functions via Goto -> Expert functions -> HTTP
the problem is that, here in SMMS, my url logon groups list is always empty...
is it normal?
regards

Hi Olivier,
In case you use Integrated ITS in a Portal environment you should have a closer look at notes 1029194 and 1040325.
Thanks and regards,
Dieter

Tab Groups are empty when loaded from tab group list

I have several tab groups which have been working successfully.
Today whenever I open a tab group the number of tabs is set to zero and all my tabs are lost. In the Tab Group List they show as 7, 19 etc.

You can check for problems with the sessionstore.js and sessionstore.bak files in the Firefox Profile Folder that store session data.
Delete the sessionstore.js file and possible sessionstore-##.js files with a number and sessionstore.bak in the Firefox Profile Folder.
*Help > Troubleshooting Information > Profile Directory: Open Containing Folder
*http://kb.mozillazine.org/Profile_folder_-_Firefox
Deleting sessionstore.js will cause App Tabs and Tab Groups and open and closed (undo) tabs to get lost, so you will have to create them again (make a note or bookmark them).
*http://kb.mozillazine.org/Multiple_profile_files_created

LDAP groups from User View

Hi All,
Can anyone tell me how I can retrieve the LDAP groups from a User View? When I retrieve a user View I don't see where the LDAP groups are located on the View. Is there an attribute I'm missing or is there an alternative mechanism to retrieve the LDAP groups from a User view?

In the user view, you will have to customize the user view form per documentation. Add a multi-select field if editing, or a list/text area using the ldapGroups from the resource. You can find more on ldapGroups in the documentation for resource adapters. Sample code also helps.

OBIEE Groups - RPD Groups, Catalog Groups, LDAP Groups

Greeting Experts
I am trying to get a clear understanding of how these different groups play out in the OBIEE world. Ideally I am looking to get clarity around what the boundaries are for these groups (what they control and don't). Really appreciate if someone could enlighten me
Thank you very much.

will LDAP Group security takes precedence over Catalog Group security
Yes
when it comes to LDAP security, can it be extended to control Authorizations besides, just User Authentication ?
Basically LDAP groups are associated with the users and those groups are again associated to Application Roles so Authorization and authentication can be done using Application role rather than a group
But if you have catalog groups (default 10g security model) you can still assign application roles for those catalog group and enable the object level security (Goto Administrator ---> Manage Catalog Groups ---> select any default 10g group there you can search and add applicatoin roles)
thanks,
Saichand

Cannot Add user to CMC Group when they are a member of LDAP group

On PreProduction Server CMC
Softerra LDAP browser used to verify user is a member of LDAP group
User does not show as a member of that group in the CMC
Cannot add user to LDAP group showing in CMC, the same group shows the member in LDAP browser
On Production Server CMC
For kicks I logged into the CMC on Production and I found the user is correctly showing as a member of the Group
Why doesn't the groups in CMC show what is actually showing in the LDAP browser?

Hi,
Check if you have also mapped in both servers the same groups. It might be that there are some groups missing in the Pre-prod.
Also, try restarting the CMS. I have seen similar issues that are solved after forcing the recreation of the graph.
If after the restart you still can't see the groups, check the mapping on the LDAP server. It might be that both servers do not use the same attribute mappings.
Regards,
Julian

Ldap schema extension to control which users / group are imported

Hello,
would like to have your opinion:
would it be a good idea to implement ldap schema extensions to control
which users / group are imported and controlled from ldap in a ldap
mastered installation?
e.g. we could implement the following schema extension for users:
attributetype ( 1.3.6.1.4.1.<iana-org-id>.1.1 NAME ( 'BogusisBeehiveUser' )
     DESC ''
EQUALITY booleanMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
SINGLE-VALUE )
# BogusinetOrgPerson
# The BogusinetOrgPerson is derived from inetOrgPerson
objectclass     ( 1.3.6.1.4.1.<iana-org-id>.1
NAME 'BogusinetOrgPerson'
     DESC 'RFC2798: Internet Organizational Person, plus Bogus Extensions'
SUP inetOrgPerson
STRUCTURAL
     MAY (
          BogusisBeehiveUser )
Then we could control the inclusion in beehive by simply switching
BogusisBeehiveUser on or off.

sure; that's pretty much what is talked about in the Install Guide for LDAP Integration under the "inclusion and exclusion" section, about here:
http://download.oracle.com/docs/cd/E14897_01/bh.100/e14830/ldap.htm#CHDEFFJF
that doesn't go into the specifics of how you might want to design your objectClass schemas, though, as beehive is agnostic to that.
If you don't want to provision all users that match a certain existing rule (like everyone under dn=foo, or everyone where userType=employee), then adding a new attribute and building the profile inclusion rule around it is a valid thing to do.
richard

Error while adding LDAP group

Hi, I configured LDAP authentication on BOXI R2 SP3 on IIS. The settings are as given below.
To change a setting, click on the value to start the LDAP Configuration Wizard. I have replaced few entries with XXXX and YYYY due to security.
LDAP Hosts: nccXXX.XXX.YYYY.XX.YY:636
LDAP Server Type: Novell eDirectory
Base LDAP Distinguished Name: ou=XXXXX,dc=YY
LDAP Server Administration Distinguished Name: cn=XXX,o=YYYYY
LDAP Referral Distinguished Name: ""
Maximum Referral Hops: 0
SSL Type: Server Authentication
Server Side SSL Strength: Always accept server certificate
Single Sign On Type: None
When I add any new group then its not added and I get below error message in the Logging directory for WCA.
Error: 2009-08-24 14:56:30, Thread:161, WriteData::_Flush catch unexcepted exception, source: System.Web, message: Specified argument was out of the range of valid values.
Parameter name: offset, stack: at System.Web.HttpResponseStream.Write(Byte[] buffer, Int32 offset, Int32 count)
at BusinessObjects.Enterprise.WebComponentAdapter.WriteData._Flush(IntPtr handle)
Can anyone help to find if LDAP is configured correctly before adding group?
Thanks,

Resolved. It was due to wrong LDAP group given to me.
Thanks,

Can an email address be a member of an LDAP group even if it isn't associated with an object in the Directory Server?

Can an email address be a member of an LDAP group even if it isn't
associated with an object in the Directory Server?
<P>
General members of a group are the members defined in the
Directory Server. They are full-fledged members of the group who
may have a set of permissions associated with their membership,
a title, or other attributes. Mail-specific users are users who
are not full-fledged members of the group, but who receive mail
sent to the group. Mail-specific users need not be identified as
a user in the Directory Server--an email address is sufficient.
An example of this is a group of salespeople, all of whom are in
the group "North American Sales Team." They have access to a
sales-tracking database, on-line quota information, and
competitive information. The mail-specific users of this group
are the admins who support the members of the sales team, who need
to get the mail that goes out to the group, but don't need access
to the applications and information that the salespeople do.

Hey EllyK,
Welcome to the BlackBerry Support Community Forums.
Thanks for the question.
I would suggest performing this workaround and then try to login to BlackBerry Link:
Open BlackBerry World on the BlackBerry smartphone and sign in using the BlackBerry ID.
Connect the BlackBerry 10 smartphone to the computer.
Open BlackBerry Link
Sign in using the BlackBerry ID.
Let me know if the issue still persists.
Cheers.
-ViciousFerret
Come follow your BlackBerry Technical Team on Twitter! @BlackBerryHelp
Be sure to click Like! for those who have helped you.
Click Accept as Solution for posts that have solved your issue(s)!

Groups are not displaying in the user's member of tab

Hi ,
We have a issue,
After mapping any AD group in CMC,the groups and users are displaying in the cmc list. but when we go to the properties of the user and member of option ,the groups are not displaying .
After restarting the CMS every thing works fine.
Every time after adding a new user we should restart the CMS, it is very difficult for us as number of users are working on this .
We are using number of AD groups.
Is there any resolution for this with out restarting the CMS.
Thank you in advance.
Environment -
BO XI3.1,
LDAP authentication.
Thanks & Regards,
Collin.

The LDAP graph is responsible for showing the membership when viewing the user properties, an issue like this would indicate the graph is not auto updating. It normally builds when starting the CMS then every 15 minutes or so for new users (depending on system activity). It shouldn't lose any info (if it does this indicates a caching or communication problem with AD). There is a graphtimeout setting in the registry (search SAP notes) if this were disabled then it may cause similar symptoms.
I'm not aware of any bugs in 3.1 causing this behavior so you may need to open a case with support (authentication team) to help troubleshoot.
Regards,
Tim

LDAP groups and WebLogic Roles - Urgent ( weblogic 6.1 sp1, iPLanet 5.1)

I have 2 questions and these are very urgent :-
1. Where the mapping can be defined between LDAP groups and WebLogic Roles. I have
2 groups in iPLanet :- Contarctors and employees and I have 2 security roles in weblogic:-
contractactors and employess. How do I map LDAP group contractors to weblogic security
Role contractors? Similarly for employees ?
2. I have not defined contarctors and employeees under People container in IPlanet.
e.g. The RDN for contractor is
uid=1234,ou=dir,dc=orams,dc=com
Can I still use the defualt security realm of weblogic (the WebLogic Security Realm
under People ) OR I have to write my own custom code ?
3. I am planning to use Roles insetad of groups to manage the logical grouping in
iPLant. Can I still use the groups in WebLogic security realm ( in the configuratin
parameters ?)
This is very urgent ....so if any of you can throw any hints that will be greatly
appreciated.
--Sunita

Hi Ariel,
The driver is bundled with the product in WLS 6.1sp1. you don't have to
download any additional driver. Use it as you normally would only thing to
remember is if you are trying to write standalone java code then you have to
have weblogic.jar in your classpath. For the rest of the info follow the wls
docs for 6.1
HTH
sree
"Ariel" <[email protected]> wrote in message
news:3bb4a643$[email protected]..
We want to connect our Weblogic 6.1 sp1 server to a SQLServer 2000 db. We
downloaded the JDriver from bea.com, but all the istructions that camewith
it are for WLserver 5.1.
What has to be done to do this with 6.1 sp1?
Thanks,
Ariel

How to make a subform not print if the fields are empty

I'm once again working on that kind of client form where our agents fill in a bunch of fields on our forms and I only want those fields that are pertinent to that client to print out and I've grouped the fields that go together into separate subforms.
There are date fields and currency fields that relayout to floating fields in hidden blocks of text that appear when the last text field is exited, ie:
Subform1 "On 5/14/12 your application was approved. We will pay $100 to your account"
Subform2 "On 5/14/12 we received your application. We will need further information before you claim for $250 can be approved" etc. Obviously, both of these subforms cannot appear on the letter.
Jono gave me a great solution for not printing checkboxes that are not checked with a preprint script which worked perfectly and I tried to adapt that to the subforms but alas my skills are lacking. I tried just putting it in each fill in field but then the blocks of text still remained.
So basically I don't want the subforms that have empty fields to print.
I'd appreciate any help that can be offered.

Hi,
I think that the logic/script should be placed in the area where the user either approves or rejects the claim. This would avoid a prePrint script to check if fields are empty or not.
If you are stuck with checking if fields are empty on prePrint, then you would just need to check the relevant fields one at a time or use a loop.
Hope that helps,
Niall

RSA authentication with LDAP group mapping

Greetings,
I'm trying to set up RSA authentication with LDAP group mapping with ACS Release 4.2(1) Build 15 Patch 3.
The problem I'm having is that my users are in multiple OU's on our AD tree. When I only put our base DN in for User Directory Subtree on ACS, it fails with a "External DB reports about an error condition" error. If I add an OU in front of it, then it will work fine.
As far as I know, you can only use one LDAP configuration with RSA.
Any thoughts on this?

@Tarik
I believe your suggestion is the only way i'm going to get this to work. I ran across a similar method just this week that I have been working on.
I was hoping for dynamic mapping with the original method, but I haven't found any way to make it happen. I have resorted to creating a Radius profile on the RSA appliance for each access group I need. Using the Class attribute, I then pass the desired Group name to the ACS, i.e. OU=Admins, and that seems to work.
Thankfully, I have a small group of users that I am attempting to map. I will only map those who need elevated priviliges to narrow down how many profiles I will have to manually create. Likewise, our Account Admin will have to determine who gets assigned a particular access group.
I would still prefer to do this dynamically.
Scott

LDAP Groups are empty

Similar Messages

Maybe you are looking for