OUD 11g / 12c - Using the "effectiverights" Control to Troubleshoot why an Attribute is not Returned by a Non-DS_ADMIN User
(Doc ID 2513332.1)
Last updated on DECEMBER 27, 2023
Applies to:
Oracle Unified Directory - Version 11.1.1.5.0 and laterInformation in this document applies to any platform.
Symptoms
LDAPSEARCH as non-admin users returns INCORRECT RESULTS -
ldapsearch -D uid=USER.1, SUFFIX_DN -b uid=USER.1, SUFFIX_DN -s base '(objectclass=*)' -> NO rows
ldapsearch -D uid=USER.1, SUFFIX_DN -b uid=USER.1, SUFFIX_DN -s base '(uid=USER.1)' -> NO rows
ldapsearch -D uid=USER.1, SUFFIX_DN -b uid=USER.1, SUFFIX_DN -s base '(orclguid={actualGuid})' -> USER.1 record
In contrast, the same searches as DS_ADMIN consistently returns results -
ldapsearch -D "cn=DS_ADMIN" -b uid=USER.1, SUFFIX_DN -s base '(objectclass=*)' -> USER.1.record
ldapsearch -D "cn=DS_ADMIN" -b uid=USER.1, SUFFIX_DN -s base '(uid=USER.1)' -> USER.1.record
ldapsearch -D "cn=DS_ADMIN" -b uid=USER.1, SUFFIX_DN -s base '(orclguid={actualGuid})' -> USER.1 record
This document goes over issues where an ldapsearch by the DS_ADMIN returns different results compared to the same search authenticating as a non-DS_ADMIN user.
Cause
To view full details, sign in with your My Oracle Support account. |
|
Don't have a My Oracle Support account? Click to get started! |
In this Document
Symptoms |
Cause |
Solution |
References |