Okta Active Directory LDAP Filter Limitations Across Multiple Domains

Active Directory LDAP filters that Okta uses for imports across multiple domains may fail to return expected results due to Microsoft Global Catalog limitations. To resolve this issue, administrators must use readily available attributes in the Global Catalog, such as the mail domain, instead of relying on group membership attributes.

When an Active Directory (AD) LDAP filter executes across multiple domains, the filter may not capture all intended users. For example, consider the following AD LDAP filter:

(&(sAMAccountType=805306368)(!(physicalDeliveryOfficeName="New York"))(!(mail=*mydomain.com)(memberOf:1.2.840.113556.1.4.1941:= CN=My OKTA users,OU=OKTA Groups,DC=a,DC=domain,DC=com)))

In this example, if the user lacks membership in the mail domain (<mydomain.com>), the recursive membership lookup (memberOf:1.2.840.113556.1.4.1941:=) may fail to capture the user. Even if trust relationships exist across all domains and the Okta AD Agent runs on all Domain Controllers (DCs), the Global Catalog does not guarantee the availability of the memberOf information.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Active Directory (AD)
• Lightweight Directory Access Protocol (LDAP)
• LDAP Filters
• Okta AD Integration

Microsoft Active Directory Global Catalog (GC) limitations prevent the replication of global group information to every domain controller. Users from a local domain controller contain group memberOf information, while users from a foreign domain controller contain limited memberOf information.

How are LDAP filter limitations resolved across multiple domains?

Modify the LDAP filter to use attributes that are readily available in the Global Catalog, rather than relying on group membership.

• For the example provided, add the mail domain of the user (for example, <(mail=*mydomain.com)(mail=*adomain.com)>) to the filter instead of relying on the memberOf attribute to ensure the filter captures the user.