search

microsoft / idfix

Microsoft IdFix
https://microsoft.github.io/idfix
MIT License
143 stars 89 forks source link

Modifications to LDAP Filter Don't Appear to Work #90

Open ccgthree opened 4 days ago

ccgthree commented 4 days ago

Our organization's user-base includes guest accounts for non-accredited continuing education programs and other types of "uncommon" users. We distinguish these users in AD with an "EduPersonPrimaryAffiliation" attribute. Some of these users have accounts related to those continuing education programs alongside their normal/standard accounts. for identification purposes, both the guest and regular accounts have the same mail address.

We intend to block guest accounts from being synced to Entra from AD.

While running IdFix, I found that filter modifications to exclude users with EduPersonPrimaryAffiliation still returned those objects. And, in our case, those are the only objects producing any errors, according to IdFix.

The filter I (tried) to use is as follows: 

(&(|(objectCategory=Person)(objectCategory=Group))(!(eduPersonPrimaryAffiliation=GUEST))(!(eduPersonPrimaryAffiliation=VOLUNTEER))(!(eduPersonPrimaryAffiliation=RETIRED))(!(eduPersonPrimaryAffiliation=ENTITY)))

is this expected behavior?

ccgthree commented 4 days ago

I should have added: The above filter works as expected when run against AD using standard cmdlets like Get-ADObject or other tools such as ldapsearch.