Disabled LDAP users still appear in the EEM UI

Products

• Autosys Workload Automation

Issue/Introduction

Disabled LDAP users continue to appear in the user listing within the CA Embedded Entitlements Manager (EEM) User Interface.

Environment

 

• CA Embedded Entitlements Manager (EEM) 12.x

• AutoSys Workload Automation configured with an external LDAP User Store

 

 

Cause

By default, the EEM user lookup synchronization pulls all objects matching the standard user object class from the external user store without automatically filtering out accounts based on their active/disabled flags in the directory.

Resolution

If you do not want disabled users to appear in the EEM listing, you can implement one of the following solutions:

• Delete the Accounts in LDAP: Request your LDAP administrator to completely delete the user IDs rather than just disabling them within LDAP itself.

• Refine the EEM User Search Filter: You can apply an operational filter to explicitly omit disabled users from appearing. To adjust this value, navigate to the following screen in the EEM user store configuration:

   

  EEM UI > Configure > User Store > LDAP Attribute Mapping > Mapping name

  Modify the User Search Filter in the top "User Lookup" section. Your LDAP administrator can recommend the exact syntax or values suited to your environment. For example, to filter out disabled users in an Active Directory environment, you can utilize:

  (&(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

See Also / Additional Information

For more details and precise syntax configurations regarding EEM user search filters, consult the product documentation:

EEM - Configure Search Filters