LDAP Change Detection Attributes

Overview

Any given entry in the CalNet Directory (LDAP) has many attributes which track when other attributes have changed. This guide covers attributes used to track CalNet Friendly ID upgrades (berkeleyEduCalNetIDUpdatedDate), entry consolidations (berkeleyEduCalNetUIDConsolidationDate), and global modifications (modifytimestamp).

Detecting a change to any part of an entry

Any time any attribute within an entry in LDAP changes, the LDAP server automatically updates the modifytimestamp attribute with the current date and time.

UTC Timestamp Format

The timestamp for this attribute is UTC, represented by the letter "Z" at the end. Example:

Conversion: If a record changed at 20080529205326Z, this equates to 1:53:26 PM Pacific Daylight Time (-7 hours from GMT). During Standard Time, the offset is -8 hours.

Searching via modifytimestamp

You can search for records changed since a specific time. For example, to search for records changed since 12:00 AM PDT 6/1/2008 (07:00:00 UTC), use this filter:

Allowed Operations

Note: This attribute only has an equality index. You must provide a specific date. A presence search (modifytimestamp=*) will not work.

Return Values: This is a unique attribute. If you want it returned in your search results, you must explicitly ask for it by name in your LDAP query.

Detecting a change to a CalNet ID

Whenever a user changes their CalNet ID, the attribute berkeleyEduCalNetIDUpdatedDate is set. Unlike modifytimestamp, this is set in Pacific Time and does not have a "Z" at the end.

Example filter for IDs changed since 12:00 AM Pacific on 6/1/2008:

Old CalNet IDs: To see a person's previous CalNet IDs, you must request access to the berkeleyEduKerberosPrincipalStringOld attribute by emailing calnet-admin@berkeley.edu.

Detecting a change to a UID (UID consolidated)

When the CalNet Team consolidates UIDs, the berkeleyEduCalNetUIDConsolidationDate attribute is set (in Pacific Time). The previous UID is stored in berkeleyEduCalNetUIDOld.

Example filter for consolidations since 6/1/2008:

Note: Do not search on berkeleyEduCalNetUIDOld. It is not an indexed attribute and will likely return no results.

Reasons for UID Changes:

1. Mismatched data between student, employee, or affiliate records during load.
2. Returning employees assigned new IDs after long absences.
3. Student ID mismatches.
4. Reconciling multiple affiliate records for a single person.

FAQs

What is the difference between berkeleyEduModDate and modifytimestamp?

• modifytimestamp: Updated automatically by the LDAP server whenever any attribute changes (including self-service updates like phone numbers or emails).
• berkeleyEduModDate: Set only by the CalNet Sync Process when data from Student, HR, or Alumni systems of record has changed.