PowerFlex Using Organizational Unit Name And Organizational Name When Adding An LDAP Service

Summary: The customer is using an Organizational Unit Name (OU) and Organizational Name (O) objects as part of its Base DN configuration on their Linux-based LDAP server. This use is less common than the traditional use of a Common Name (CN), Organizational Unit Name (OU), and Domain Component (DC) only. ...

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Instructions

According to PowerFlex documentation, --ldap_fqdn, --username_dn_format, and --search_filter_format parameters are used when the LDAP server is Linux-based.

The needed parameters according to PowerFlex documentation:

scli --add_ldap_service
--ldap_service_uri  
--ldap_base_dn 
[--ldap_fqdn ]
[--ldap_service_name ]
[--username_dn_format ]
[--search_filter_format ]

For example, an ldapsearch output:

-bash-4.2$ ldapsearch -v -W -H "ldaps://ldap-prox01.corp.comptest.com:636 [ldap-prox01.corp.comptest.com]" -D "cn=svc-block-storage,ou=headless,o=Identities" -b "ou=People,o=identities" "(&(objectClass=OATHUser)(uid=testuser))" cn groupMembership objectClass
 ldap_initialize( ldaps://ldap-prox01.corp.comptest.com:636/??base [ldap-prox01.corp.comptest.com] )
 Enter LDAP Password:
 p11-kit: overriding trust for anchor in blacklist: addtrust-external-root.p11-kit
 filter: (&(objectClass=OATHUser)(uid=testuser))
 requesting: cn groupMembership objectClass
 
extended LDIF
 
 #
   LDAPv3
   base  with scope subtree
   filter: (&(objectClass=OATHUser)(uid=testuser))
   requesting: cn groupMembership objectClass
 #
   testuser, Employee, people, identities
 dn: cn=testuser,ou=Employee,ou=people,o=identities
 cn: testuser
 groupMembership: cn=CompTest,ou=People,o=Identities
 groupMembership: cn=Employee-General,ou=Groups,ou=People,o=Identities
 groupMembership: cn=Github-Enterprise-Users,ou=Groups,ou=People,o=Identities
 groupMembership: cn=block_storage-operator,ou=Groups,ou=People,o=Identities
 groupMembership: cn=block_storage-admin,ou=Groups,ou=People,o=Identities
 objectClass: Top
 objectClass: Person
 objectClass: organizationalPerson
 objectClass: inetOrgPerson
 objectClass: ndsLoginProperties
 objectClass: OATHUser
 objectClass: DirXML-PasswordSyncStatusUser

The correct command structure, according to the ldapsearch output is:

scli --add_ldap_service --ldap_service_uri "ldaps://ldap-prox01.corp.comptest.com" --ldap_base_dn "ou=People,o=Identities" --ldap_fqdn "ldap-prox01.corp.comptest.com" --ldap_service_name "corp_ldap" --username_dn_format "cn=[USER],ou=Employee,ou=people,o=Identities" --search_filter_format "(&(objectClass=OATHUser)(cn=[USER])(groupMembership=[GROUP]))"

LDAP Glossary


Base DN
The partially qualified name (or container context) specifying the "starting point" for a search or access to a directory.

Distinguished Name (DN)
A distinguished name is a fully qualified name that uniquely identifies an entity in a directory.

Common Name (CN)
If the object holding this attribute corresponds to a person, it is typically the person’s full name.

Organizational Unit (OU) and Organization (O)
Typically used to create a hierarchy of containers within a domain.

Only OUs within the same domain can have relationships. OUs of the same name in different domains are independent.

Affected Products

PowerFlex Software, VxFlex Product Family, VxFlex Ready Node, Ready Node Series

Products

ScaleIO Ready Node-PowerEdge 13G
Article Properties
Article Number: 000203237
Article Type: How To
Last Modified: 19 Feb 2025
Version:  3
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.