Is there any impact to the Service Desk LDAP integration if an Active Directory (AD) Domain or Forest is changed or migrated?

Products

• CA Service Desk Manager
• CA Service Management - Service Desk Manager

Issue/Introduction

This document explains what will happen to Service Desk Contact information if LDAP integration is used and the AD Domain is changed. It also outlines the steps that need to be taken if that AD domain is changed.

Environment

CA Service Desk Manager

All versions

Resolution

If the AD Domain that is integrated with Service Desk is changed and the pdm_ldap_sync utility is run, all Contacts with LDAP attributes will be set to inactive. This is because their existing ldap_dn attribute does not match that of the new AD domain.

You need to update the value in the ldap_dn attribute in the Contact object (in the usp_contact MDB table) with the new AD domain name before you run the pdm_ldap_sync utility.

You can do this using the following steps:

1. Take an extract of the usp_contact table by running the following command on the SDM server:
   
   

   pdm_extract usp_contact > contacts.txt

2. Edit the contacts.txt file with a text editor and change all the occurrences of the old domain values for the ldap_dn attribute to the new domain value.  For example, change "DC=domain1,DC=example,DC=com" to "DC=domain2,DC=example,DC=com"
   
   
3. Update the LDAP options in options manager (Administration tab -> Options Manager -> LDAP) to reflect the new AD domain.
   
   
4. Restart the Service Desk services.
   
   
5. Run the pdm_load command on the SDM server to update the ldap_dn value for the contacts using the file edited in step # 2:
   
   

   pdm_load -a -v -f contacts.txt

6. Run the pdm_ldap_sync utility and verify that the utility synchronises the contacts correctly.