How to Provision an object with multiple objectclasses in LDAP server

  • Article

It is a common scenario when you want to provision an object with structural objectClasses to a LDAP server. So how can we achieve this by Generic LDAP connector in FIM? ( Generic LDAP management agent is published by Microsoft and supposed to work with any LDAP system. You can download it here.)

By some search, I find the below function which seems to point out the possible solution. There is an override constructor for the method to pass the additional objectclasses as a collection. With below code snippet, I found it didn’t work as expected.

ConnectorCollection.StartNewConnector Method (String, ValueCollection)

 ValueCollection objectClassValues = Utils.ValueCollection(new String[] { "fimAccount", "contosoExternalUser","contosoStudent”});
CSEntry csEntry = openldapMA.Connectors.StartNewConnector("fimAccount", objectClassValues);

After digging into the implementation of Generic LDAP, I am aware it relies on the attribute called “objectClass” to detect the desired structure classes. So instead of passing the collection to the call, we shall flow the attribute into objectClass. Of course, you need to add an attribute called objectClass by extending the Schema in the LDAP server. Here’s the code snippet which works in my lab.

 ValueCollection objectClassValues = Utils.ValueCollection(new String[] { "fimAccount", " contosoExternalUser"," contosoStudent”});
CSEntry csEntry = openldapMA.Connectors.StartNewConnector("fimAccount");
csEntry["objectClass"].Values = objectClassValues;

Further, with this feature we can also easily provision the object using a declarative synchronization Rule. Adding an export attribute flow in outbound rule to LDAP system is enough, then the export logic will do the magic for you.