ReportServer - ReportServer Admin Guide 4.7

20.38. ldaptest

Tests LDAP filter, GUID, users, groups and organizational units as configured in sso/ldap.cf. Configuration options are described in the Configuration Guide.

Note that you can use the >>> operator for sending the command results to a given datasink. This may be useful for long command outputs for better result analysis. You can also use > for new file creation or >> for file append. Details of all terminal operators can be found in Chapter 19. Terminal Operators.

When troubleshooting your LDAP configuration, you should run the commands shown next in the order shown below, as some of them are based on correct configuration. E.g. ldaptest users needs a correct filter installed, so ldaptest filter should be checked first.

ldaptest filter
ldaptest guid
ldaptest groups
ldaptest organizationalUnits
ldaptest users
ldaptest orphans

20.38.1. ldaptest filter

Allows you to test the installed filter and prints the results.

If the -a flag is entered, requests and displays additional LDAP attributes. These must be separated by semicolon (;).

E.g., in order to display the mail, member and ou attribute values of each entry, you can enter the following:

ldaptest filter -a mail;member;ou

Use: ldaptest filter [-a]

20.38.2. ldaptest guid

Allows you to test the installed GUID and prints the results.

Additionally this command also scans your usertree for duplicate uses of the same GUID. If duplicates are detected you resolve them before importing users using ldapimport.

Use: ldaptest guid

20.38.3. ldaptest groups

Allows you to show the LDAP groups together with their attributes (in the sso/ldap.cf configuration file) that would be imported in an ldapimport execution.

If the -s (schema) flag is entered, the schema of the groups' object class is shown. This may be useful for finding out other group properties that can be entered into the ldap.cf configuration file. You can also use the ldapschema command for further exploring your object class attributes (refer to 20.37. ldapschema).

If the -a flag is entered, requests and displays additional LDAP attributes. These must be separated by semicolon (;).

E.g., in order to display the instanceType and groupType attribute values of each group, you can enter the following:

ldaptest groups -a instanceType;groupType

Use: ldaptest groups [-s] [-a]

20.38.4. ldaptest organizationalUnits

Allows you to show the LDAP organizational units together with their attributes (in the sso/ldap.cf configuration file) that would be imported in an ldapimport execution.

If the -s (schema) flag is entered, the schema of the organizational units' object class is shown. This may be useful for finding out other organizational unit properties that can be entered into the ldap.cf configuration file. You can also use the ldapschema command for further exploring your object class attributes (refer to 20.37. ldapschema).

If the -a flag is entered, requests and displays additional LDAP attributes. These must be separated by semicolon (;).

E.g., in order to display the distinguishedName and commonName attribute values of each group, you can enter the following:

ldaptest groups -a distinguishedName;commonName

Use: ldaptest organizationalUnits [-s] [-a]

20.38.5. ldaptest users

Allows you to show the LDAP users together with their attributes (in the sso/ldap.cf configuration file) that would be imported in an ldapimport execution.

If the -s (schema) flag is entered, the schema of the users' object class is shown. This may be useful for finding out other user properties that can be entered into the ldap.cf configuration file. You can also use the ldapschema command for further exploring your object class attributes (refer to 20.37. ldapschema).

If the -a flag is entered, requests and displays additional LDAP attributes. These must be separated by semicolon (;).

E.g., in order to display the memberOf and nickname attribute values of each user, you can enter the following:

ldaptest user -a memberOf;nickname

When retrieving information about LDAP users, internal users are checked for possible username collisions when importing. If detected you will notice an additional conflicts with column which holds the id of the user with the same username. Resolve these conflicts bevor importing.

Use: ldaptest users [-s] [-a]

20.38.6. ldaptest orphans

Your LDAP filter should exclusively retrieve all users, groups, and organizational units. If additional nodes are returned, or if the mappings in ldap.cf are incorrect, nodes may be retrieved that cannot be mapped to a user, group, or organizational unit. These are referred to as LDAP orphans. In a properly installed and configured system, LDAP orphans should not exist. Therefore, LDAP orphans occur when your LDAP filter returns too much data. You can easily list all LDAP orphans using this terminal command.

If the -a flag is entered, requests and displays additional LDAP attributes. These must be separated by semicolon (;).

Use: ldaptest orphans [-a]