My Oracle Support Banner

OUD 11g / 12c - Using the "effectiverights" Control to Troubleshoot why an Attribute is not Returned by a Non-DS_ADMIN User (Doc ID 2513332.1)

Last updated on DECEMBER 27, 2023

Applies to:

Oracle Unified Directory - Version 11.1.1.5.0 and later
Information in this document applies to any platform.

Symptoms



LDAPSEARCH as non-admin users returns INCORRECT RESULTS -

ldapsearch -D uid=USER.1, SUFFIX_DN -b uid=USER.1, SUFFIX_DN -s base '(objectclass=*)' -> NO rows

ldapsearch -D uid=USER.1, SUFFIX_DN -b uid=USER.1, SUFFIX_DN -s base '(uid=USER.1)' -> NO rows

ldapsearch -D uid=USER.1, SUFFIX_DN -b uid=USER.1, SUFFIX_DN -s base '(orclguid={actualGuid})' -> USER.1 record

 

In contrast, the same searches as DS_ADMIN consistently returns results -

ldapsearch -D "cn=DS_ADMIN" -b uid=USER.1, SUFFIX_DN -s base '(objectclass=*)' -> USER.1.record

ldapsearch -D "cn=DS_ADMIN" -b uid=USER.1, SUFFIX_DN -s base '(uid=USER.1)' -> USER.1.record

ldapsearch -D "cn=DS_ADMIN" -b uid=USER.1, SUFFIX_DN -s base '(orclguid={actualGuid})' -> USER.1 record



This document goes over issues where an ldapsearch by the DS_ADMIN returns different results compared to the same search authenticating as a non-DS_ADMIN user.

Cause

To view full details, sign in with your My Oracle Support account.

Don't have a My Oracle Support account? Click to get started!

In this Document
Symptoms
Cause
Solution
References

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.