AnsweredAssumed Answered

Configuring LDAP Collector

Question asked by Neha Singh on Jan 20, 2020
Latest reply on Apr 21, 2020 by Ian Staines

Like • Show 0 Likes0
Comment • 8

Hi,

The scenario is: I am trying to setup a LDAP connection where the user data is like -

User Role

John Role1, Role2, Role3

Bob Role2, Role3

So, basically it becomes a multi-valued attribute and the results are not as expected in the test.I am able to get the first value from the role column and rest are rejected. I have so many applications which could not be automated and have being doing manual review generation which is quite dis-satisfying and time taking.

Does anyone came across this requirement? or any alternative which can be used would be helpful.

Thanks!

Ian Staines

Jan 20, 2020 10:43 AM

Correct Answer

The LDAP collectors do not support multi-valued attributes.

See the reply in context

No one else had this question

Outcomes

8 Replies

Ian Staines Jan 20, 2020 10:43 AM
Unmark Correct
Correct Answer
The LDAP collectors do not support multi-valued attributes.
Like • Show 0 Likes0
Actions
- Mostafa Helmy @ Ian Staines on Feb 6, 2020 7:04 AM
  Mark Correct
  Correct Answer
  As Ian said, it is not currently supported with out LDAP-based collector. Feel free to raise an new Idea on RSA Ideas for RSA Identity Governance & Lifecycle
  
  You could also export the data (using PowerShell for example) into a CSV file and collect from that file instead.
  Like • Show 0 Likes0
  Actions
  - Markus Calmius @ Mostafa Helmy on Apr 21, 2020 3:13 AM
    Mark Correct
    Correct Answer
    Why does this need an idea?
    This is according to the directory standard, shouldn't multi-valued attributes be supported by default? To me, this is clearly a bug.
    Like • Show 0 Likes0
    Actions
    - Ian Staines @ Markus Calmius on Apr 21, 2020 11:42 AM
      Mark Correct
      Correct Answer
      The statement was not meant to be pejorative. We fully acknowledge that the product does not currently support collecting multi-valued LDAP attributes. You are welcome to call this a "bug" if you like. At this time no customers have requested this feature in the product through the RSA Ideas Page and as such there is currently no plan to add this feature.
      
      Note that the lack of support for multi-valued attributes is not really a limitation only of the collector, and not only a limitation of the LDAP collector specifically.
      Like • Show 0 Likes0
      Actions
Neha Singh Jan 21, 2020 3:39 AM
Mark Correct
Correct Answer
Is there any alternative to setup such applications?
Like • Show 0 Likes0
Actions
- Zoltan Izsak @ Neha Singh on Jan 21, 2020 4:57 AM
  Mark Correct
  Correct Answer
  You should use ldap groups and group memberships to represent roles or entitlements.
  1 person found this helpful
  Like • Show 1 Like1
  Actions
  - Neha Singh @ Zoltan Izsak on Jan 24, 2020 5:08 AM
    Mark Correct
    Correct Answer
    This will work when I have AD groups but this case is for user attributes which are multi valued.
    Like • Show 0 Likes0
    Actions
    - Zoltan Izsak @ Neha Singh on Jan 27, 2020 10:16 AM
      Mark Correct
      Correct Answer
      You can write your own collector in Java. This is always an option though not an easy way (or at least not easy for me).
      
      Also you can write a script which exports your multi-valued AD attributes into csv and in a second step you can collect from that csv. Also not a nice solution but it can work.
      Like • Show 0 Likes0
      Actions

Configuring LDAP Collector

Outcomes

Related Content

Recommended Content