Hi

What we learn in the past months, is that you need to have a principal ISAM User Registry configured (with secuser objects) but other "basic" accounts can be locked up as well in secondary user registry such as Active Directory, using the same UserLookupHelper() object. But the way you initialize it is different.

For you ISAM Principal user registry, it can be as simple as this:

            ldapUserEmailAttribute = "mail";

            ldapFilter="(&(objectclass=ABCEmployee)( ldapUserEmailAttribute=*))";

            hlpr = new UserLookupHelper();

            hlpr.init(ldapConnection, ldapFilter, "tenantE");

Whereas users that reside in secondary user registries (such as Active Directory), you can initialize you userLookupHelper() as follow:

            hlpr = new UserLookupHelper();

            hlpr.init(false);

In the above case, the configuration is seeded from the ldap.conf configuration file (see Federated User Registry link https://www.ibm.com/support/knowledgecenter/SSPREK_9.0.2/com.ibm.isam.doc/admin/task/tsk_manage_lite_users.html).

We have high hopes that in ISVA V10, we will be able to leverage the new NativeLDAPHelper() object to handle users located in secondary user registries with a more "direct" approach as opposed than relying on the Federated Directory approach.

Hope this helps.

Hi

What we learn in the past months, is that you need to have a principal ISAM User Registry configured (with secuser objects) but other "basic" accounts can be locked up as well in secondary user registry such as Active Directory, using the same UserLookupHelper() object. But the way you initialize it is different.

For you ISAM Principal user registry, it can be as simple as this:

            ldapUserEmailAttribute = "mail";

            ldapFilter="(&(objectclass=ABCEmployee)( ldapUserEmailAttribute=*))";

            hlpr = new UserLookupHelper();

            hlpr.init(ldapConnection, ldapFilter, "tenantE");

Whereas users that reside in secondary user registries (such as Active Directory), you can initialize you userLookupHelper() as follow:

            hlpr = new UserLookupHelper();

            hlpr.init(false);

In the above case, the configuration is seeded from the ldap.conf configuration file (see Federated User Registry link https://www.ibm.com/support/knowledgecenter/SSPREK_9.0.2/com.ibm.isam.doc/admin/task/tsk_manage_lite_users.html).

We have high hopes that in ISVA V10, we will be able to leverage the new NativeLDAPHelper() object to handle users located in secondary user registries with a more "direct" approach as opposed than relying on the Federated Directory approach.

Hope this helps.

Hi

What we learn in the past months, is that you need to have a principal ISAM User Registry configured (with secuser objects) but other "basic" accounts can be locked up as well in secondary user registry such as Active Directory, using the same UserLookupHelper() object. But the way you initialize it is different.

For you ISAM Principal user registry, it can be as simple as this:

            ldapUserEmailAttribute = "mail";

            ldapFilter="(&(objectclass=ABCEmployee)( ldapUserEmailAttribute=*))";

            hlpr = new UserLookupHelper();

            hlpr.init(ldapConnection, ldapFilter, "tenantE");

Whereas users that reside in secondary user registries (such as Active Directory), you can initialize you userLookupHelper() as follow:

            hlpr = new UserLookupHelper();

            hlpr.init(false);

In the above case, the configuration is seeded from the ldap.conf configuration file (see Federated User Registry link https://www.ibm.com/support/knowledgecenter/SSPREK_9.0.2/com.ibm.isam.doc/admin/task/tsk_manage_lite_users.html).

We have high hopes that in ISVA V10, we will be able to leverage the new NativeLDAPHelper() object to handle users located in secondary user registries with a more "direct" approach as opposed than relying on the Federated Directory approach.

Hope this helps.