LDAP Disabled User Synchronization in Clarity

[CA AEC]

Hello,

We are currently using the following LDAP filter in the Security tab of NSA:

(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=512)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

This filter allows Clarity to read only active users from LDAP.

However, we are facing an issue where users who are subsequently disabled in LDAP remain active in Clarity and must be manually disabled.

We would like to know if there is an option or recommended approach that automatically updates the status of users in Clarity when they are disabled in LDAP. Our goal is to have user accounts in Clarity automatically reflect the disabled status from LDAP without requiring manual intervention.

We appreciate your guidance on this.

Regards,

Samad Abdul Aleem

[Suman Pramanik]

Duplicate of earlier thread 

------------------------------
Thanks & Regards
Suman Pramanik
------------------------------

[CA AEC]

I observed that if an invalid syntax is provided in the Search Filter, the "LDAP - Synchronize Obsolete Users" job still runs without reporting any errors, whereas the "LDAP - Synchronize New and Changed Users" job fails.

Based on this behavior, I assume that the "LDAP - Synchronize Obsolete Users" job is not handling or validating this condition in the Search Filter in the same way as the "LDAP - Synchronize New and Changed Users" job.

[Suman Pramanik]

Hi Samad

That could be the problem, if you haven't logged this via support team, please do so and then we can further investigate and once we confirm the findings we can revert back here. 

------------------------------
Thanks & Regards
Suman Pramanik
------------------------------