When using a contact connector in CMN DirSync to query LDAP in a Domino environment, excluding any OU from the source causes the connector to fail to find any objects. The environment contains both domino Person objects at the root and in a subcontainer (O=subcontainer). If the LDAP root is selected as the source, and an OU is excluded, the connector fails to find any objects, even in the root. However, when no OUs are excluded, the connector finds objects in both the root and the subcontainer, resulting in unintended object synchronization.
This issue disrupts workflows that rely on excluding certain subcontainers, as there is a separate connector meant to handle the objects in the subcontainer. Therefore, excluding OUs is essential to maintain the intended synchronization behavior.
The CMN DirSync behavior is a result of how the application handles the "OUs to Exclude" option. According to the application design, the "OUs to Exclude" field is used to exclude the selected OU and all of its child objects from synchronization. However, the issue arises when any OU is excluded, causing the connector to fail to find any objects, even outside the excluded subtree.
Currently, there is no accepted fix or update for this behavior from the production team. The application's behavior for excluding OUs is functioning as designed, meaning the feature is not meant to exclude selective OUs while maintaining synchronization in the rest of the LDAP tree.
Understand Application Behavior: The exclusion of OUs affects not only the selected OU but also its subcontainers. Therefore, the "OUs to Exclude" field should be used carefully when setting up synchronization to ensure it aligns with the desired sync structure.
OU=Contoso,O=Cubasic|OU=Quest,O=Cubasic.Separate Connectors for Different OUs: To work around this limitation, you can continue using separate connectors for different OUs as planned. This setup ensures that you can manage distinct workflows for different subtrees.