Reconciliation - Windows Active Directory - Bypass/Filter certain accounts

Question

Hello experts,
Accounts in our Active Directory have an attribue employeeType. We want to load employeeType of "E" and "G" into our IDM repository. There are other employeeType's which we do not want to load. For example we are not interested in AD accounts with an employeeType of "R" so we prefer not to load them into IDM.
1 solution is to load the employeeType's we want into an organization and all other employeeType's into a different organization then delete the account from the different organization when recon is finished. Not real efficient, but it would work.
Are there other ideas we are over looking?

Answer 1

We decided to not filter Active Directory accounts. Instead accounts we are not interested in are assigned to an organization we call Non User Accounts. We might delete those accounts from that organization after the recon runs, but have not decided at this time.
If you want to filter Active Directory accounts you'll need to modify ADSIResourceAdapter. The method that needs modified is: "public AccountIterator getAccountIterator()". The code bolded below is where you will need to add your ldap filter parms.
Here is the method from the ADSIResourceAdapter:
public AccountIterator getAccountIterator()
throws WavesetException
String method = "getAccountIterator";
HashMap params = new HashMap();
String objectCategory = getOptionalStringResAttrVal("Object Category");
if(objectCategory != null)
params.put("Search Filter String", "(objectCategory=" + objectCategory + ")");
} else
String objectClass = getOptionalStringResAttrVal("Object Class");
if(objectClass == null || objectClass != null && "user".equalsIgnoreCase(objectClass.trim()))
params.put("Search Filter String", "(search filter here");
AccountIterator result = null;
try
result = getBlockAccountIterator(params);
catch(WavesetException e)
if(_util != null)
_util.logString(1, e.getMessage());
TRACE.info1("getAccountIterator", e.getMessage());
throw e;
return result;
If we were to change this method the 'search filter here' would be changed to (|(employeeType=E)(employeeType=G)).
Another fix might be to use the LDAPResourceAdapter. We did not explore that option in great depth. However it appears it would work once configured correctly.
Hope this helps someone.