Adding Mapping Plug-Ins Extending Mappings Using Custom Plug-ins

Configuring Directory Synchronization 6-19

6.6.1 Filtering Changes with an LDAP Search

For connected directories that do not support change logs, the latest footprint of the entries are obtained by performing an LDAP search. Because an LDAP search that is performed with objectclass= will return all entries in a given tree or subtree, to retrieve only the objects of interest for synchronization, you must provide a filter using LDAP filter syntax. For example, you can assign a search filter to the orclOdipConDirMatchingFilter attribute. You specify the filter as searchfilter=LDAP_SEARCH_FILTER. The following example creates an LDAP search filter that retrieves organizational units, groups, and users, but not computers: searchfilter=|objectclass=groupobjectclass=organizationalUnit objectclass=userobjectclass=computer

6.6.2 Filtering Changes from a Change Log

For connected directories that store changes in a change log, you can use the following simple operators, which are provided by Oracle Directory Integration Platform, to specify a matching filter for either the Connected Directory Matching Filter orclODIPConDirMatchingFilter or the OID Matching Filter orclODIPOIDMatchingFilter: ■ = equal operator ■ = not equal operator You can use the preceding operators with either LDAP or non-LDAP directories, provided they obtain incremental changes from a change log. Wildcards and pattern matching are not supported with the preceding operators if you do not use the searchfilter attribute. However, when multiple operator pairs are including in the filter, the expression is evaluated as a logical AND operation. For example, the following expression includes four operator pairs: objectclass=groupobjectclass=organizationalUnit objectclass=userobjectclass=computer The preceding expression evaluates as follows: objectclass is equal to group AND objectclass is equal to organizationalUnit AND objectclass is equal to user AND objectclass is NOT equal to computer For connected directories that store changes in a change log, a matching filter can synchronize changes for only the attributes that appear in the change log. If you include attributes in a matching filter that do not appear in the change log, the search operation will fail. For this reason, matching filters are of limited use for connected directories that store incremental changes in a change log. Note: Connected directories that obtain incremental changes through an LDAP search can also use the preceding operators without the searchfilter attribute. However, you can only specify a single expression or the search will fail.