What can LDAP do?

Check lockout status for customers
Determine if customer is active (employee or student)
Identify a customer's account status and affiliation with SJSU
Determine if customer is in any DUO group/Adobe group
LDAP is also viewable from SAMI Gateway: https://sjsu-its.atlassian.net/wiki/spaces/SDKB/pages/2644279301/SAMI+Gateway#Active-Directory-(LDAP)

On this page

1 What can LDAP do?
2 Important Fields
- - 2.1.1 Formatting the Filter
- 2.2 Glossary
3 Tutorials
- 3.1 Set up LDAP (Configure SJSUAD Profile)
- 3.2 Search LDAP

PLEASE NOTE:

You will need to configure you LDAP browser on each PC that you use. Please do so ASAP.
In case you are using LDAP on a non-institutional network, connect to VPN in order to use LDAP.

Important Fields

Formatting the Filter

Softerra LDAP browser uses the standard LDAP query format.

(attribute=value)

---The parentheses are necessary.

You may also use wildcard filters by using an asterisk

(attribute=val*)

Glossary

accountExpires	Either Never or date
badPasswordTime	Timestamp
badPwdCount	count
cn	common name=givenName middleName sn
department	department name
departmentNumber	department number
displayName	same as cn (?)
distinguishedName	x.500 name, long and ugly
employeeID	employee id or SJSU ID#
employeeNumber	employee id
employeeType	always Employee if true (?)
givenName	first name
homeDirectory	UNC path to home directory
homeDrive	drive letter assigned for home directory
ipPhone	Cisco 5-digit extension
lastLogon	timestamp
lastLogonTimestamp	timestamp (but not same as lastLogon?)
lockoutTime	unspecified or time
logonCount	count
mail	email address
memberOf	group memberships, may be more than one
middleName	middle initial
name	same as cn (?)
objectCategory	always “CN=Person,CN=Schema,CN=Configuration,DC=SJSUAD,DC=SJSU,DC=EDU”
ou	Applicants, Employees, Students or Vendors
physicalDeliveryOfficeName	always “C” until it’s fixed
pwdLastSet	timestamp
sAMAccountName	employee id for login purposes
sjsuIsEmployee	TRUE or FALSE
sjsuPersonAffiliation	Employee Faculty, Employee Staff, Student Applicant, Student
sn	surname (last name)
telephoneNumber	full phone number
title	title
userPrincipalName	email address style login name
whenCreated	account creation timestamp

Set up LDAP (Configure SJSUAD Profile)

Check your Scope Pane (the left-hand column) for an SJSUAD profile. If it’s there, you’re done.
Click the New Profile option under the New button pull-down.
Set SJSUAD as the profile name and click Next
Set sjsuad.sjsu.edu as the Host
Set the Port as 636
Click the Fetch Base DNs, and select DC=SJSUAD,DC=SJSU,DC=EDU
Check the Use secure connection (SSL) the click Next
Select Currently logged on user (Active Directory only)

9. Click Finish

The scope pane should fill in with the AD tree information.

Search LDAP

Open Softerra LDAP Browser; Double-Click the icon
Click the '+' sign next to SJSUAD in the scope pane
Right-click 'sjsuPeople' in the scope pane
Pick “Directory Search” from the context menu
Enter your search criteria in the “Filter” line. (employeeid=xxxxxxxxx)
Click 'Search' button at bottom of window
Double-click on the person in the results area to show all account attributes in the main window.

Service Desk Training

LDAP

Analytics