LDAP Search Operator Limitations for SAP User Group Date Attributes in CA Identity Manager

Products

• CA Identity Suite
• CA Identity Manager

Issue/Introduction

This article explains why Greater than (>) and Less than (<) operators do not function with the eTSAPUserGroupValidFrom and eTSAPUserGroupValidTo LDAP attributes in CA Identity Manager, and outlines the recommended workaround.

Environment

Identity Manager 14.x

Cause

The eTSAPUserGroupValidFrom and eTSAPUserGroupValidTo attributes are defined as String types within the SAP parser schema (sapparse.ptt). Because they are not defined as Date types, the Provisioning Server does not support mathematical comparison operators (Greater than/Less than) for these fields.

You can verify this schema definition by running the dumpptt utility: X:\CA\Identity Manager\Provisioning Server\bin>dumpptt.exe -f -t ..\data\sapparse.ptt -of d:\temp\sapptt.txt

The output will confirm the attribute is defined as: EditType: 0 [string]

Resolution

1. Confirm Limitation: Acknowledge that because these attributes are defined as strings, mathematical LDAP comparison operators are not supported by design.
2. Implement Workaround: To use these date fields in Policy Xpress (PX) or advanced search filters, you must map these attributes to a custom global user field within Identity Manager.
3. Configure Mapping: Ensure the custom global user field is configured to accept date values, allowing the system to perform accurate date-based comparisons.
4. Enhancement Request: If your business requirements necessitate native LDAP date comparison support, please submit an Enhancement Request via the Broadcom Product Management portal.

Additional Information

• For detailed steps on attribute mapping in Identity Manager, refer to the CA Identity Manager Documentation.
• To speak with a customer representative or a Support Engineer, see Contact Support. Scroll to the bottom of the page and click on your respective region.