LDAP Integration and Attributes FAQ

How can an LDAP bind get a list of the groups it has access to?

You can perform an ldapsearch using an authenticated bind. For example:

ldapsearch -H ldaps://ldap.berkeley.edu -x -D "uid=YOUR_BIND_ID,ou=applications,dc=berkeley,dc=edu" -W -s sub -b "ou=campus groups,dc=berkeley,dc=edu" "(&(objectclass=*)(cn=edu:berkeley:app:calmessages*))" "dn"

---

How do I ask to see expired affiliates and inactive employees/faculty? Do I just request access to OU=expired people?

A: Yes. Request access to ou=expired people and specify the specific fields you need to retrieve as part of your privileged bind request.

Do I request separate access for OU=guests?

A: Yes. ou=guests is a separate Organizational Unit. Access to this OU must be requested explicitly to receive access to the fields within it.

Are expired guest accounts put into OU=expired people as well?

A: No. Expired guest accounts are typically deleted from the directory after a period of time rather than being moved to the expired OU.

Are objects in OU=expired people eventually deleted?

A: No. For non-guest accounts, records are generally not deleted (except in cases of duplicates), even after they have expired.

Are objects in OU=people immediately moved upon expiration/termination?

A: No. Each affiliation type has an associated grace period. The record will only move to ou=expired people once all active affiliations have passed their respective grace periods. Records with an Advancement Constituent (Alumni) affiliation will move to ou=advcon.

Is berkeleyEduAffExpDate the correct attribute to query for expired affiliates?

A: The berkeleyEduAffExpDate in the ou=people main record is set when all affiliate affiliations have expired. If you need to know when a particular individual affiliation expired, you must check the berkeleyEduAffExpDate on the sub-records (objectclass: berkeleyEduPersonAffiliate). Access to these sub-records must be requested separately.

Is berkeleyEduEmpTerminationDate the correct attribute to query for retired or former staff/faculty?

A: Not necessarily. We use berkeleyEduEmpExpDate to determine the grace period. The termination date reflects when employment officially ended, but the berkeleyEduEmpExpDate may be later depending on when the system was updated.

Why do some people in affiliated orgs not have an email attribute?

A: The berkeleyEduAlternateID field is the primary email address; however, it is not a required attribute. Some employees and affiliates choose not to have an email address listed.

Why are Oracle views missing first/last name when LDAP has givenName and cn?

A: berkeleyEduFirstName and berkeleyEduLastName (associated with givenName and cn) are only populated if a user has set a Lived Name via the Directory Update process. This Lived Name is what populates the displayName. If no Lived Name is set, the displayName defaults to the name provided by the system of record (UCPath, SIS, etc.).

---