How to create a new LDAP user label (4306235)

It is possible to import LDAP labels during an LDAP import, however, it is unlikely that all labels imported would be utilized, thus filling up the LDAP label list with multiple unused queries.  It is possible to manually create necessary LDAP labels, but it is a multi-step process.  This article will go over creating an LDAP user label and provide an example when using a security group for a filter.

Search filters are environment specific.  For more information, please see: How to setup LDAP Authentication 

For more information on this topic, please see the KACE-SMA Course 3 Appliance Fundamentals-Web-based Training.

Creating an LDAP label requires multiple parts, each with its own steps.  The two main parts of creating an LDAP label are:

1. Creating a manual label (container)
2. Creating the LDAP filter (label) (LDAP Smart Label)

Creating a Manual Label (to be used in an LDAP label):

1. Go to Home | Label Management | Labels
2. Use Choose Action | New Manual Label
3. Name the label the exact name desired for the final LDAP Label
4. Add a description if desired (this will show in the LDAP label as well)
5. Uncheck Alternate Location
6. Restrict Label Usage To (choose type of label being created) (for this example, check Users)
7. Click Save

Creating the LDAP Filter (Label):

1. Go to Home | Label Management | LDAP Labels
2. Use Choose Action | New

NOTE: The Enabled check box should not be chosen until the label is fully tested and the proper KACE variable has been added.  See information about the Advanced Search in step 8 below.

3. Choose Type (Device or User) (for this example, choose User)
4. Use the Associated Label drop-down box to choose the manual label created in the steps above
5. Fill in the Server with IP or Hostname of the server
6. Fill in the port with either 389 or 636 (ldaps)
7. Fill in the Base DN
   1. The K1000 is recursive and will search every directory below the chosen Base DN.  (for this example, it could simply be: DC=domain,DC=com, where domain.com is replaced with the actual domain)
8. Fill in the Advanced Search (filter)
   1. An example user filter using a Security Group: (&(samaccountname=KBOX_USER_NAME)(memberof=CN=GroupName,OU=OrganizationName,DC=domain,DC=com))

NOTE: Filters are environment specific, but do require the proper KACE variable to apply properly.  Please see LDAP Filters Tips and Tricks for more information.

NOTE: Attempting to use Test in an LDAP Label Detail will fail if the KACE variable exists.  For testing, use an asterisk (*) where the KACE variable will go, and then once the filter is confirmed, change the asterisk (*) to the proper KACE variable.  Failing to change the asterisk to the proper KACE variable before enabling the LDAP label can cause the incorrect users / devices (or all users / devices) to be applied to the label.  For more information, please see Testing and Applying LDAP Labels

9. Fill in the Login
   1. ​username@domain
   2. domain\username
   3. Full Distinguished Name of the user
10. Fill in the Password
    1. Though read only rights are all that are necessary for these credentials, we suggest a password that never changes, or it will need to be updated on every label manually each time it changes.
11. Click Save

NOTE: LDAP user labels DO NOT automatically update.  It will be necessary to use a custom rule or create an import on a schedule (typically this will need to be for all users).  LDAP user labels are evaluated on user import, but it will be necessary to import every user regularly to keep labels in sync.  Users are not removed from the label when they are removed/moved in the directory.