Verifying synchronized users from AD to OD

[Andreas Baaserud Hauge]

Hi,

I have synchronized users from AD to OD with ARSLSYNC.
After synchronization, the user is found in OD.

When I look at the user with our OD Admin client, I cant see anything referring to AD for that user.
Is there a way to distinguish a synchronized AD user from a regular OD user? with regular I mean a user I have created in OD directly.

Best regards Andreas BH

[rjrussel]

That would be a good enhancement request.


However, it's pretty simple to know what's synced. Get list of all users in OD and subtract what's in the ignore list. What is left came from LDAP.

Is there something I am missing that you need?

-Rob

[Andreas Baaserud Hauge]

This is part of my troubleshooting regarding a new SSO setup, from Content Navigator

As you mention regarding "ignore list", this user is not part of the "ignore list", so I can assume the user is actually an AD user.

Content Navigator / OD throws me an exception: com.ibm.edms.od.ODException: The User ID or Password is not valid for the server
So this is why I am checking if there's anything wrong with the user.

the user is logged in to the same AD domain on his windows machine, so based on that the user id and password he is using is correct.

Out setup
Application versions:
WebSphere Network Deployment
Version: 8.5.5
Fixpack: 20
Interimfix: IFPH42728
Content Navigator: 3.0.7
OnDemand: 10.1.0.5
DB2: 11.1.1.1
 
New setup, enable SSO:
WebSphere

• Federated repository with LDAP
• SPNEGO with Kerberos

Content Navigator

• Redeployed Navigator with “applicationserverauthentication”
• A desktop with SSO enabled

OnDemand – ars.cfg

• Integrating LDAP
• Synchronized users with ARSLSYNC

Do you have any suggestions for further troubleshooting?

[rjrussel]

Does SSO work for other ID's in ICN?

[Andreas Baaserud Hauge]

No, SSO does not work for anyone.

In OnDemand Administrator client, under System Parameters -> Login Information -> Login Processing. I now ticked on "Password Case Sensitive". I previously only ticked on "Enable LDAP".

When both "Password Case Sensitive" and "Enable LDAP" is ticked on, the user can now log in with his AD account.