Skip to main content
Question

LDAP Mappings - only dsAttrTypeNative?

  • May 20, 2014
  • 6 replies
  • 43 views
D
Forum|alt.badge.img+18

I am working on mapping out information from AD into the LDAP server mappings in the JSS, and am wondering if only "dsAttrTypeNative" type data is able to be mapped. We have information in a dscl read of a user which is not listed as "dsAttrTypeNative:", and currently I can not map this into the LDAP server mappings. A couple such items are "EMailAddress:", "JobTitle:", etc., without being prefixed by "dsAttrTypeNative:". Any idea if this is possible and how to map these into the LDAP mappings? Any help is much appreciated. I want to avoid having to write a script to pull this information, if possible.

    6 replies

    mm2270
    Forum|alt.badge.img+24
    • mm2270
    • Legendary Contributor
    • May 20, 2014

    I'm not sure about all of these, but we have ours set up for email to pull from an attribute simply labeled as "mail"
    If I do the following against our AD with a username-

    dscl "/Active Directory/DOMAIN/All Domains" read /Users/username mail

    It outputs the actual email address - something like

    dsAttrTypeNative:mail: firstname.lastname@company.com

    Try using that to see if that maps properly in your environment. I'm not sure where the Job Title would come from since we don't currently map that.

    bentoms
    Forum|alt.badge.img+35
    • bentoms
    • Hall of Fame
    • May 20, 2014

    Hi @dgreening][/url,

    You can drop the dattributesnative bit.

    As an example, our mappings are included in the below post.

    We map email & job title.

    http://macmule.com/2014/05/04/submit-user-information-from-ad-into-the-jss-at-login-v2/

    D
    Forum|alt.badge.img+18
    • dgreening
    • Author
    • Honored Contributor
    • May 20, 2014

    Ah I see. I used "Title" instead of "JobTitle" and it pulls in correctly. Thanks guys!

    D
    Forum|alt.badge.img+18
    • dgreening
    • Author
    • Honored Contributor
    • May 20, 2014

    Additionally, on version 9.3, when I have the JSS set to collect user information from LDAP automatically, it seems not to respect the mappings that I have made for out LDAP server in the JSS. I remember this being normal behavior in 8.73, but am not sure if this is still the case in 9.3. Looks like I am going to have to go the script route after all...

    bentoms
    Forum|alt.badge.img+35
    • bentoms
    • Hall of Fame
    • May 21, 2014

    @dgreening, mine works fine on 9.3.

    What are you seeing?

    I'm guessing that the LDAP tests work fine, is the user's attributes not populating?

    Well you need to trigger them... How are you doing that?

    Try the script in my blog post linked earlier if LDAP Mappings are testing ok.

    D
    Forum|alt.badge.img+18
    • dgreening
    • Author
    • Honored Contributor
    • May 21, 2014

    What I am seeing in my 9.3 environment (test) versus my 8.73 environment (production) is that my 9.3 environment is not respecting the "-ldapServerID" selection in my Recon statement. I have two LDAP (AD) servers in our JSS, and in 8.73, selecting the server at position 1 works fine, but does not work with either position 1 or 2 in 9.3. I was able to work around this by adjusting the mappings for both AD servers so that they line up, and now it works fine.

    Terms & ConditionsCookie settingsAccessibility statement