LDAP - test - can find the account but cant find under Users on JSS

[akamenev47]

Hi,

I am having a strange issue, where I can find the user account under LDAP > Test feature, but it does not find that same account under Users on JSS... Anybody seen this before?

I can find another account in both: LDAP > Test and under Users, which are located in the same OU on the AD, but this particular one I can't, which doesn't make any sense...

Appreciate any suggestions on this!

[akamenev47]

For example, my admin account is found at both locations...

[sdagley · Accepted solution]

@akamenev47 has that account enrolled a Computer or Device in Jamf Pro, or been assigned as the user for one? If not they won't appear in Users yet. Searching users doesn't do an LDAP query, it's just a search of the users assigned to a device enrolled with Jamf Pro.

[akamenev47]

Thank you so much, I had no idea about this!

[ega]

@akamenev47  The other place this caught me was checking "Authentication Required" in a PreStage.  If the user has not been assigned to a device, etc then they will not be able to authenticate.  I had to move to an enrollment customization using LDAP instead.

[sdagley]

@ega Using "Authentication Required" should definitely do an LDAP query for authentication for users who have never previously enrolled a device with Jamf Pro. The only time I've seen that fails is when a user's AD password is in the "must change on next login" state.

[ega]

@sdagleyjust bit me twice teaching a short course to our Site admins using 10.32.2 two weeks ago 

[sdagley]

@ega You may want to open a case with Jamf Support to investigate. The "Authentication Required" option in a  PreStage Enrollment can definitely do an LDAP lookup of a user not previously associated with a device in Jamf Pro. If it couldn't my org's onboarding process wouldn't work.

[ega]

@sdagley You are right.  Turns out the users that could not login were not correctly provisioned in our LDAP.  Thanks for pointing that out.

[ega]

@sdagley  So you are right.  My issue was not passing thru to my LDAP server but that the 2 users in question were not correctly provisioned in said LDAP.  Thanks for helping me clear that up!