Pulling AD Department

Benjamin_Diehl
New Contributor II

Hello,

Im an intern and I have been tasked with trying to figure out how to get JSS to pull the Department field from AD and then they want me to create a Smart Group with the search criteria of Departments. I have looked all over JSS but I can't seem to figure out how to get AD to pull that information. In the system settings for the LDAP AD server Departments has the correct attribute but then when I search a user JSS is still not pulling the information from AD.

1 ACCEPTED SOLUTION

mscottblake
Valued Contributor

@Benjamin.Diehl That's a script that Internal JAMF IT uses. I didn't write it. I've made attempts at using it though, before realizing it wouldn't work in my institution.

There are some alterations that need to be made in the script. Particularly: https://github.com/jamfit/JSS-LDAP-Sync/blob/master/JSS-LDAP-Sync.py#L13-L14 and https://github.com/jamfit/JSS-LDAP-Sync/blob/master/JSS-LDAP-Sync.py#L137

And also maybe: https://github.com/jamfit/JSS-LDAP-Sync/blob/master/JSS-LDAP-Sync.py#L128-L134 or https://github.com/jamfit/JSS-LDAP-Sync/blob/master/JSS-LDAP-Sync.py#L141-L142

View solution in original post

17 REPLIES 17

RogerH
Contributor II

@Benjamin.Diehl you need to enter all of the departments into the jss manually first for them to be populated. I know it sucks but once you do it as long as you have all of the AD settings correct departments will populate.

mm2270
Legendary Contributor III

Can you be a little more specific on what you need to pull, from where? From what you wrote, it sounds like you're saying you need to create a piece of criteria that will pull in the AD department info that can later be used to build a Smart Group. Is that right?

Benjamin_Diehl
New Contributor II

@mm2270 Yes that is correct.

@RogerUL Are you talking about when you go to management settings>Network Organization>Departments, because just to test I added one of our departments but it still hasn't pulled the information.

RogerH
Contributor II

@Benjamin.Diehl you will need to run sudo jamf recon to force an inventory on the client to get it to populate. and they have to be entered exactly including all white spaces or it will not work.

mm2270
Legendary Contributor III

It will only update per computer when the computer submits inventory, if I'm not mistaken. Until at least some of your Macs send in new inventory, you're not going to see anything update.

RogerH
Contributor II

@Benjamin.Diehl you also should verify your collecting that information in your inventory settings.

Benjamin_Diehl
New Contributor II

I noticed in the LDAP AD server attributes there is a user mapping attribute listed as Department, that seems like it has the flexibility to pull the Active Directory department attribute. 1. Is it possible to build a smart group from that attribute? 2. Is it possible to have that show up in the user details too?

@RogerUL @mm2270

RogerH
Contributor II

@Benjamin.Diehl yes it is possible. you need to go to your computer management settings make sure collect user and location info from LDAP is checked in computer inventory collection 65f6d276691145d893f80e54a2cc44a5
you also need to make sure in your computer inventory display settings that department is checked 2bb4759d589b4d9eaf872298f2a78dc0

to create a smart group you will create a computer smart group with the department is.. setting.

Benjamin_Diehl
New Contributor II

Is it all possible for the Department information to also be placed into the users. Basically this all comes down to, we are moving our school wide iPad program to JSS. We are wanting to create smart groups based on peoples departments. For example our Admissions (staff) in AD have the department of ADMS, we are wanting JSS to pull that and place it in the users so that we can build a smart group that then places all of the admissions people in that group and then from there set up profiles.

@RogerUL

iJake
Valued Contributor

Make an Extension Attribute with an input type of LDAP Attribute Mapping. In standard AD schema this attribute would be "department" minus the quote. You can then build Smart Groups from this information.

mscottblake
Valued Contributor

I'm just going to leave this here... https://github.com/jamfit/JSS-LDAP-Sync

Benjamin_Diehl
New Contributor II

Great thanks that is working sorta, no idea what the username and password it though. Everything we have tried hasn't worked even our IT director can't get the username or password right.

@mscottblake

mscottblake
Valued Contributor

@Benjamin.Diehl That's a script that Internal JAMF IT uses. I didn't write it. I've made attempts at using it though, before realizing it wouldn't work in my institution.

There are some alterations that need to be made in the script. Particularly: https://github.com/jamfit/JSS-LDAP-Sync/blob/master/JSS-LDAP-Sync.py#L13-L14 and https://github.com/jamfit/JSS-LDAP-Sync/blob/master/JSS-LDAP-Sync.py#L137

And also maybe: https://github.com/jamfit/JSS-LDAP-Sync/blob/master/JSS-LDAP-Sync.py#L128-L134 or https://github.com/jamfit/JSS-LDAP-Sync/blob/master/JSS-LDAP-Sync.py#L141-L142

Benjamin_Diehl
New Contributor II

@mscottblake OH ok thanks will try these other ones out

cdenesha
Valued Contributor III

As mentioned previously, and from your questions above you already know this but just to update the thread: you will want "Collect user and location information from LDAP" checked , but for iPads it is in 'Mobile Device Inventory Collection' -> 'Inventory Collection". You will need to create the Department manually. You will need to tell the JSS which AD field to get the Department value from, at 'System Settings' -> 'LDAP Servers' -> [your server] -> Mappings -> 'User Mappings' (we use "department" without the quotes). Then when the iPad's Update Inventory command is processed, the JSS will update the record with whatever is currently in AD.

As of JSS 9.65, User and Location settings are not available on the User side. Have not had time to look at 9.7x. Please upvote the FR that this is a duplicate of.

chris

Benjamin_Diehl
New Contributor II

Thanks guys for all the input and help :)

@RogerUL @mm2270 @iJake @mscottblake @cdenesha

fgonzale
Contributor

@cdenesha once I map the AD attributes for department and building will older computer objects in Jamf also have their User and Location inventory field updated via the LDAP info (assuming I created the corresponding Buildings and Departments in Jamf) or will this only apply to new computers being enrolled into Jamf?