LDAP Integration and Attributes FAQ

How can an LDAP bind get a list of the groups it has access to?

A: You can perform an ldapsearch. For example:
ldapsearch -H ldaps://ldap.berkeley.edu -x -D "uid=ist-as-wa-ezsvn,ou=applications,dc=berkeley,dc=edu" -W -s sub -b "ou=campus groups,dc=berkeley,dc=edu" "(&(objectclass=*)(cn=edu:berkeley:app:calmessages*))" "dn"

How do I ask to see expired affiliates and inactive employees/faculty? Do I just request access to OU=expired people?

A: Yes. Request access to ou=expired people and specify the specific fields there that you need to retrieve.

Do I request separate access for OU=guests?

A: Yes. ou=guests is a separate Organizational Unit. If you request access to this OU, you will receive access to all fields within it.

Are expired guest accounts put into OU=expired people as well?

A: No. Expired guest accounts are typically deleted from the directory after a period of time rather than being moved to the expired OU.

Are objects in OU=expired people eventually deleted?

A: No. For non-guest accounts, we do not delete records unless there is a duplicate record, even after they have expired.

Are objects in OU=people immediately moved upon expiration/termination?

A: No. Each type of affiliation has an associated grace period which varies from 0 days for Temp Agency Staff to 9 months for students. The record will move to OU=expired people only if all affiliations have passed their grace periods. Note that those who have an affiliation as an Advancement Constituent (primarily alumni) will be moved to ou=advcon.

Is berkeleyEduAffExpDate the correct attribute to query for expired affiliates?

A: The berkeleyEduAffExpDate in the ou=people main record is set when all affiliate affiliations are expired. If you need to know when a particular individual affiliation is expired, you will need to check the berkeleyEduAffExpDate for the sub-records, which have an objectclass of berkeleyEduPersonAffiliate. Access to these sub-records must be requested separately.

Is berkeleyEduEmpTerminationDate the correct attribute to query for retired or otherwise former staff and faculty?

A: Not necessarily. We use the berkeleyEduEmpExpDate to determine the grace period. The termination date reflects the date the employment ended. The berkeleyEduEmpExpDate is the day we were informed the job ended, if that date is later than the termination date.

Are the Oracle views pulling all Person object schema attributes and do they contain inactive/expired/terminated people?

A: If you are referring to the CalDAP Oracle DB, yes, they pull all of the records. However, these views typically do not retain the expired data once the grace period has passed.

With our current privileged bind I see that people in affiliated orgs do not have any email attribute, is that normal and/or a voluntary attribute?

A: Yes. The berkeleyEduAlternateID field is the primary email address; however, some employees and affiliates have opted not to have one. It is not a required attribute.

The Oracle views are missing first name and last name, but have displayName. I see that in LDAP the same accounts have a givenName and cn, so is that normal?

A: Yes. berkeleyEduFirstName and berkeleyEduLastName (associated with givenName and cn) are only filled in if someone goes into the Directory Update app and selects a "preferred name." This preferred name will be the name reflected in the displayName. If a person does not select a preferred name, the displayName is automatically updated using the employee name, the student name, or the affiliate name, in that order of preference.