LDAP - Additional User DN and no value is supplied

[Sona Husakova]

Hi,

our customer have one AD with domain domain.com and two OU named "Users INT" and "Users EXT" in the setting Additional User DN. If he supplied to Additional User DN no value, it does not run properly. How to set value to Additional User DN?

Thanks for quick answer !

Soňa

[Josh Steckler]

Hi Sona,

The "Additonal User DN" field isn't to add a second OU. It puts the Additonal User DN in front of your Base DN specifically when searching for users. In your case, where you have two top level user OUs, you either need to set the base dn to the top level (DC=domain,DC=com) or set up two directories pointing to the different OUs on the same domain.

[Sona Husakova]

Hi Josh,

thanks for your answer.

Customer already tried to set up two directories pointing to the different OUs on the same domain and also tried to set up base DN to the top level (DC=domain,DC=com) and "Additional User DN" had empty (here was many messages in log file for the same group etc.). Any setting does not run properly.

Another solution?

[Josh Steckler]

What is your LDAP Permissions mode set to? Try Read Only, with Local Groups if you're not using that already. This might help with "same group" errors.

Also try unchecking Advanced Settings--> Follow Referrals if checked.

You might also need to write User Object and Group Object filters so that you only bring in the necessary users and groups.

[Sona Husakova]

Hi Josh,

thank you for your quick feedback. I don't know what  is their LDAP Permission mode set to, but I will find out.

Try what you advised.

Thanks and have a nice day !

I will write.

Best Regards,

Soňa