Disabled users in LDAP- Manually needs to be disabled in clarity

[Samad AbdulAleem]

Hello,

We are currently using the following LDAP filter in the Security tab of NSA:

(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=512)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

This filter allows Clarity to read only active users from LDAP.

However, we are facing an issue where users who are subsequently disabled in LDAP remain active in Clarity and must be manually disabled.

We would like to know if there is an option or recommended approach that automatically updates the status of users in Clarity when they are disabled in LDAP. Our goal is to have user accounts in Clarity automatically reflect the disabled status from LDAP without requiring manual intervention.

We appreciate your guidance on this.

Regards,

Samad Abdul Aleem

[Suman Pramanik]

Clarity's LDAP sync is split into two separate scheduled jobs:

 

1. "Synchronize new and changed users" (add/modify) - imports/updates users found by your LDAP filter. This is the job most environments have running.

2. "Synchronize obsolete users" (delete/inactivate sync) - a separate job whose job is exactly to inactivate Clarity users who are no longer returned by your LDAP filter.

 

The second job re-runs your exact CSA search filter (the userAccountControl filter you quoted) per active Clarity user. Since a disabled AD account fails (!(userAccountControl:...:=2)), it no longer matches - the job detects "user not found in remote directory" and sets the Clarity user status to inactive automatically, then pushes it via XOG.

 

So the auto-disable mechanism you're asking for already exists - it's driven entirely by your existing filter, no extra config flag needed.

 

Most likely root cause

 

The "Synchronize obsolete users" job is probably not scheduled/enabled in your environment (only the add/modify sync is). That would produce exactly the symptom you're seeing: new/changed AD users sync fine, but users disabled after their initial import never get reconciled.

------------------------------
Thanks & Regards
Suman Pramanik
------------------------------

[Samad AbdulAleem]

For some reason it does not get disabled. I have to manually set it to
inactive initially. I know about the two jobs related to LDAP. I ran
multiple times the job, but same result. I tried all possible combinations
but still not working.

[Samad AbdulAleem]

I also observed that if an invalid syntax is provided in the Search Filter, the "LDAP - Synchronize Obsolete Users" job still runs without reporting any errors, whereas the "LDAP - Synchronize New and Changed Users" job fails.

Based on this behavior, I assume that the "LDAP - Synchronize New and Changed Users" job is not handling or validating this condition in the Search Filter in the same way as the "LDAP - Synchronize Obsolete Users" job.

[Suman Pramanik]

Hi Samad

That could be the problem, if you haven't logged this via support team, please do so and then we can further investigate and once we confirm the findings we can revert back here. 

------------------------------
Thanks & Regards
Suman Pramanik
------------------------------

[Luis Palacios]

Hi Samad, have you tested the LDAP query externally, if you have an admin with the RSAT cmdlets or similar, you can test using LDAPFilter or similar to discard the query itself