Establishing a Connection

Adding a Connection to LDAP

To add a connection to LDAP:

In the application console, navigate to the Connections page.
At the Add Connections panel, select the icon for the connection you want to add.
If the LDAP icon is not available, click the Add More icon to download and install the LDAP connector from the CData site.

For required properties, see the Settings tab.

For connection properties that are not typically required, see the Advanced tab.

Connecting to LDAP

The CData driver for the LDAP supports connecting to LDAP server objects. To connect, set the required properties.

Required Properties

Server: The domain name or IP of the LDAP server.
Port: The port setting defaults to port=389. Specifying the port to a different setting is optional.
BaseDN: This property is used for limiting results to specific subtrees. Specifying a narrow BaseDN (Base Distinguished Name) may greatly increase performance. For example, a value of cn=users,dc=domain only returns results contained within cn=users and its children.

Optional Properties

Optional properties can be used to further refine control of the returned results.

FollowReferrals: This property follows referrals when TRUE. The returned response then becomes read only. To modify data returned by a referral server, open a new connection to the server by specifying server and port.
Scope: This property enables more control over the search depth of the LDAP tree, starting with BaseDN. Limiting the Scope can greatly improve search performance. Set the Scope to one of the following values:
- WholeSubtree: Limit the scope of the search to the BaseDN and all of its descendants.
- SingleLevel: Limit the scope of the search to the BaseDN and its direct descendants.
- BaseObject: Limit the scope of the search to the base object only.
LDAPVersion: The LDAP version used to connect to and communicate with the server. Set this property to 2.

Authenticating to LDAP

To authenticate requests, set the User and Password properties to valid LDAP credentials. For example: set User to Domain\\BobF or cn=Bob F,ou=Employees,dc=Domain.

The AuthMechanism properties for the Sync App are as follows:

SIMPLE: The default plaintext value of the authentication mechanism to login to the server.
NEGOTIATE: Negotiates whether to use NTLN or Kerberos when authenticating to the server.

SSL Configuration

By default, the driver uses plaintext when communicating with the server set to port=389. The driver automatically switches to use SSL when talking to the LDAP on port=636. You can force the connection to use the SSL connection property when set to SSL=TRUE.

Customizing Tables

The Sync App surfaces the columns most often needed from LDAP entities. However, if you need to work with other data, the tables are easy to modify. Tables are defined in schema files, which have a simple format.

See Working with LDAP Tables for a guide to extending the default schemas or writing your own. To use custom schemas, set the Location property to the folder containing the schema files. For more on tables and views, see Data Model.

Working with LDAP Tables

The Sync App includes table schemas for many standard LDAP objects. You can easily extend the included table schemas to edit column behavior or you can write your own from scratch.

Table schemas are defined in .rsd files, which are simple configuration files. This section will walk through different parts of the schema, adding several columns to the Person table as an example.

You can find the Person.rsd file in the db subfolder in the installation folder of the CData Sync App.

Connecting to Custom Tables

To use custom schemas, set the Location property to the folder containing the schema files.

Defining a New Table

It is important to define a new table with the same name as the object class that the table will represent. This will allow the Sync App to search for only the desired object class when querying the LDAP server. The file name defines the table name.

Defining Table Columns and Inputs

Columns are defined in the rsb:info block, a shown below. The attr tags in the schema represent the columns of the table. These should match the attributes that make up the desired object class.

There are a few columns that every table should include, regardless of the object class:

<rsb:script xmlns:rsb="http://www.rssbus.com/ns/rsbscript/2">
<rsb:info title="Person" description="Create, update, delete, and query person entries in Active Directory.">
<!-- Required Columns -->
<attr name="Id"          xs:type="string" readonly="true"  key="true"        />
<attr name="DN"          xs:type="string" readonly="true"  required="false" other:ldaptype="OID" />
<attr name="RDN"         xs:type="string" readonly="true"  required="false" other:ldaptype="Directory String" />
<attr name="BaseDN"      xs:type="string" readonly="true"  required="false" other:ldaptype="OID" />

Note: The title attribute of the rsb:info block must match the name of the .rsd file.

Customizing Column Behavior

Each column requires at least name and xs:type attributes. Additionally, you will need to specify dataFormat to decide how data is returned from the table. For example:

<!-- Person Required Attributes -->
<attr name="ObjectClass"                 other:dataFormat="splitDataByRow" xs:type="string" readonly="false" required="false" other:ldaptype="OID" />
<attr name="SN"                          other:dataFormat="delimitedData"  xs:type="string" readonly="false" required="false" other:ldaptype="Directory String" />
<attr name="CN"                          other:dataFormat="delimitedData"  xs:type="string" readonly="false" required="false" other:ldaptype="Directory String" />

<!-- Person Optional Attributes -->
<attr name="UserPassword"                other:dataFormat="delimitedData"  xs:type="string" readonly="false" required="false" other:ldaptype="Binary" />
<attr name="TelephoneNumber"             other:dataFormat="delimitedData"  xs:type="string" readonly="false" required="false" other:ldaptype="Directory String" />
<attr name="SeeAlso"                     other:dataFormat="delimitedData"  xs:type="string" readonly="false" required="false" other:ldaptype="DN" />
<attr name="Description_1"               other:dataFormat="splitDataByCol" xs:type="string" readonly="false" required="false" other:ldaptype="Directory String" />
<attr name="Description_2"               other:dataFormat="splitDataByCol" xs:type="string" readonly="false" required="false" other:ldaptype="Directory String" />
<attr name="Description_3"               other:dataFormat="splitDataByCol" xs:type="string" readonly="false" required="false" other:ldaptype="Directory String" />

The other:dataFormat attribute has three options:

delimitedData: Return multiple LDAP attribute values as delimited strings, separated by the delimiter character defined in the Table Settings section of the .rsd file, detailed later.

This is the default format in which to retrieve data and the delimiter defaults to a semicolon.
splitDataByRow: Push multiple LDAP attribute values for the same DN as separate rows. All other columns will be pushed consistently, and the index in Id will be incremented. Note: Pushing multiple columns like this will exponentially grow the result set, potentially causing performance issues.
splitDataByCol: Push multiple LDAP attribute values for the same DN with an appended index on the column name. You need to define multiple columns and append an "_n" to the end; for example, ObjectClass_1, ObjectClass_2, and ObjectClass_3. In this example, if there are more than 3 values, the remaining values will not be visible in the table, unless more columns are added.

Example: Splitting the ObjectClass Attribute

The code below can be used to split the different values of the ObjectClass attributes into their own rows and Description attributes into their own columns. Notice the column definition now includes multiple columns for the Description attribute. Also note the other:dataFormat attribute for the attr.

...
<attr name="ObjectClass"     other:dataFormat="delimitedData" xs:type="string"  readonly="false" required="false" other:ldaptype="OID" />
<attr name="SN"              other:dataFormat="delimitedData" xs:type="string"  readonly="false" required="false" other:ldaptype="Directory String" /> 
<attr name="CN"              other:dataFormat="delimitedData" xs:type="string"  readonly="false" required="false" other:ldaptype="Directory String" /> 
<attr name="UserPassword"    other:dataFormat="delimitedData" xs:type="string"  readonly="false" required="false" other:ldaptype="Binary" />
<attr name="TelephoneNumber" other:dataFormat="delimitedData" xs:type="string"  readonly="false" required="false" other:ldaptype="Directory String" />
<attr name="SeeAlso"         other:dataFormat="delimitedData" xs:type="string"  readonly="false" required="false" other:ldaptype="DN" />
<attr name="Description_1"   other:dataFormat="delimitedData" xs:type="string"  readonly="false" required="false" other:ldaptype="Directory String" />
<attr name="Description_2"   other:dataFormat="delimitedData" xs:type="string"  readonly="false" required="false" other:ldaptype="Directory String" />
<attr name="Description_3"   other:dataFormat="delimitedData" xs:type="string"  readonly="false" required="false" other:ldaptype="Directory String" />

</rsb:info>

<!-- Table Settings -->
<rsb:set attr="delimiter" value=";"/>
...

An example result will look like:


Id	DN	ObjectClass	SN	CN	UserPassword	TelephoneNumber	SeeAlso	Description_1	Description_2	Description_3
1\|CN=User1,DC=Test	CN=User1,DC=Test	Top	TestSN	User1		555-5555	A;B;C	Desc1	Desc2	Desc3
2\|CN=User1,DC=Test	CN=User1,DC=Test	User	TestSN	User1		555-5555	A;B;C	Desc1	Desc2	Desc3

Specifying Column Encoding

In addition to data format on inputs, encoding can also be specified. Currently, returning data with UTF8 encoding or BASE64 encoding is supported. In order to retrieve data with a specified encoding, the other:encoding field must be specified for the desired attribute to be encoded. If no encoding is specified, UTF8 is the default.

An example of specifying encoding for an attribute:

...
<attr name="ObjectClass"     other:dataFormat="delimitedData" other:encoding="UTF8"   xs:type="string"  readonly="false" required="false" other:ldaptype="OID" desc="The object class of the entry."/>
<attr name="SN"              other:dataFormat="delimitedData" other:encoding="BASE64" xs:type="string"  readonly="false" required="false" other:ldaptype="Directory String"           desc="The surname of the person."/> 
...

Modifying Filter Behavior

Optionally, there are two attributes that can be used to control how filtering is handled when using the driver with SupportEnhancedSQL. The other:ldaptype attribute can be used to set the LDAP syntax of a field. This is used to determine the comparison operators that are supported server-side on a per-field basis. For example, if a field is marked as the type 'DN' and a query filtering for a substring (i.e., CONTAINS), which is not supported server-side, the driver will instead process this part of the filter entirely client-side. The supported type names are found in section 4.3.2 of RFC 2252. If you are unsure of the type or just want to disable server-side filtering for a given column entirely, the other:filterable attribute is also available. Setting this to false for the field will prevent this from ever being sent to the server in a filter, overriding the other:ldaptype attribute entirely.

Configuring Table Settings

In addition to the attributes and inputs, you will need to specify the delimiter.

The delimiter specifies the character that will be used for delimited data. Delimited data will be returned for any attribute that appears multiple times for a single object (unless otherwise specified in other:dataFormat).

For example, the code below will concatenate multiple values of an attribute using the ';' character.

...
</rsb:info>  

<!-- Table Settings -->
<rsb:set attr="delimiter" value=";"/>
...

Defining Supported Operations

Operation definitions will remain exactly the same for all newly created tables: Simply copy and paste these from an existing table, as needed.

  <!-- Operation definitions -->
  <rsb:script method="GET">
    <rsb:set attr="action" value="Get" />
    <rsb:call op="ldapadoLDAP" >
      <rsb:push />
    </rsb:call>
  </rsb:script>

  <rsb:script method="POST">
    <rsb:set attr="action" value="Post" />
    <rsb:call op="ldapadoLDAP" >
      <rsb:push item="toout"/>
    </rsb:call>
  </rsb:script>

  <rsb:script method="MERGE">
    <rsb:set attr="action" value="Merge" />
    <rsb:call op="ldapadoLDAP" >
      <rsb:push />
    </rsb:call>
  </rsb:script>

  <rsb:script method="DELETE">
    <rsb:set attr="action" value="Delete" />
    <rsb:call op="ldapadoLDAP" >
      <rsb:push />
    </rsb:call>
  </rsb:script>

Advanced Features

This section details a selection of advanced features of the LDAP Sync App.

User Defined Views

The Sync App supports the use of user defined views, virtual tables whose contents are decided by a pre-configured user defined query. These views are useful when you cannot directly control queries being issued to the drivers. For an overview of creating and configuring custom views, see User Defined Views .

SSL Configuration

Use SSL Configuration to adjust how Sync App handles TLS/SSL certificate negotiations. You can choose from various certificate formats;. For further information, see the SSLServerCert property under "Connection String Options" .

Firewall and Proxy

Configure the Sync App for compliance with Firewall and Proxy, including Windows proxies. You can also set up tunnel connections.

Query Processing

The Sync App offloads as much of the SELECT statement processing as possible to LDAP and then processes the rest of the query in memory (client-side).

For further information, see Query Processing.

Logging

For an overview of configuration settings that can be used to refine CData logging, see Logging. Only two connection properties are required for basic logging, but there are numerous features that support more refined logging, which enables you to use the LogModules connection property to specify subsets of information to be logged.

SSL Configuration

Customizing the SSL Configuration

To enable TLS, set the following:

UseSSL: True
Port: 636

With this configuration, the Sync App attempts to negotiate TLS with the server. The server certificate is validated against the default system trusted certificate store. You can override how the certificate gets validated using the SSLServerCert connection property.

To specify another certificate, see the SSLServerCert connection property.

Firewall and Proxy

Connecting Through a Firewall or Proxy

Set the following properties:

To use a proxy-based firewall, set FirewallType, FirewallServer, and FirewallPort.
To tunnel the connection, set FirewallType to TUNNEL.
To authenticate, specify FirewallUser and FirewallPassword.
To authenticate to a SOCKS proxy, additionally set FirewallType to SOCKS5.

Data Model

The CData Sync App models LDAP data as an easy-to-use SQL database. It also includes Stored Procedures that extend the functionality of the Sync App.

Tables

The included Tables cover many standard object classes, which define the structure and rules for LDAP directory entries. You can easily extend the table schemas to map more closely to your LDAP classes by modifying simple configuration files. See Working with LDAP Tables for a guide to customizing table schemas.

Note: To use custom tables and schemas, set the Location property to the folder containing the schema files.

The following tables are shipped with the Sync App.


Table	Description
Group	Stores a list of user Distinguished Names (DNs) for managing access and security roles on organizational resources.
OrganizationalPerson	Contains organizational details about a user, such as employee number, department, manager, job title, office address, and more. This class is commonly used for directory information systems.
Person	Stores personal information about a user, including general details such as name and contact information.
Top	The root class from which all other LDAP classes are derived. It provides foundational attributes for other directory classes.
User	Stores information about employees, contractors, or long-term visitors in an organization. Includes attributes such as name, contact details, and job-related information.

Stored Procedures

Stored Procedures are scripts that are invoked via SQL queries. They perform tasks beyond standard CRUD operations, including exposing LDAP reports as tables, and creating attachments.

Tables

The Sync App models the data in LDAP as a list of tables in a relational database that can be queried using standard SQL statements.

LDAP Connector for CData Sync Tables


Name	Description
Group	Stores a list of user Distinguished Names (DNs) for managing access and security roles on organizational resources.
OrganizationalPerson	Contains organizational details about a user, such as employee number, department, manager, job title, office address, and more. This class is commonly used for directory information systems.
Person	Stores personal information about a user, including general details such as name and contact information.
Top	The root class from which all other LDAP classes are derived. It provides foundational attributes for other directory classes.
User	Stores information about employees, contractors, or long-term visitors in an organization. Includes attributes such as name, contact details, and job-related information.

Group

Stores a list of user Distinguished Names (DNs) for managing access and security roles on organizational resources.

Table Specific Information

Select

All columns support server-side processing for the operators =, >= , <=, !=, LIKE, AND, and OR. Other filters are executed client side within the Sync App. For example, the following query is processed by LDAP:

SELECT * FROM Group WHERE  GroupType != '-2147483644' AND  ObjectClass = 'top;group' LIMIT 5

Insert

To add a Group, all fields can be specified except Id, DN, and BaseDN. Required fields that should be provided are RDN and ObjectClass. For example:

INSERT INTO Group (RDN, ObjectClass) VALUES ('CN=Domain Admins', 'group')

Update

All columns except Id, DN, and BaseDN can be updated by providing the Id in the WHERE clause. For example:

UPDATE Group SET Member = 'CN=SUPPORT_388945a0,CN=Users,DC=MyDC' WHERE Id = '1|CN=HelpServicesGroup,CN=Users,DC=MyDC'

Delete

Groups can be deleted by providing the Id of the Group in a DELETE statement. For example:

 DELETE FROM Group WHERE Id = '1|CN=HelpServicesGroup,CN=Users,DC=MyDC'

Columns


Name	Type	ReadOnly	References	DataFormat	Description
Id [KEY]	String	True			A combined index and Distinguished Name (DN) uniquely identifying the group. Multiple indices are supported if the column is set to 'SplitDataByRow'.
DN	String	True			The full Distinguished Name (DN) that uniquely identifies the group in the LDAP directory.
RDN	String	False			The Relative Distinguished Name (RDN), representing the unique portion of the DN within its parent container.
BaseDN	String	True			The base Distinguished Name (BaseDN) indicating the starting point for LDAP operations related to the group.
GroupType	String	False		DelimitedData	A set of flags that define the type and scope of the group object, such as whether it is a security or distribution group. Refer to LDAP documentation for possible values.
ObjectClass	String	False		SplitDataByRow	A list of LDAP object classes from which the group is derived, defining its attributes and behavior.
Member	String	False		DelimitedData	A list of Distinguished Names (DNs) representing users or other groups that are members of this group.
NTGroupMembers	String	False		DelimitedData	An unused attribute related to legacy Windows NT group membership functionality.
OperatorCount	String	False		DelimitedData	Tracks the number of operators assigned to this group for administrative purposes.
AdminCount	String	False		DelimitedData	Indicates whether the object's Access Control Lists (ACLs) have been adjusted for higher security due to membership in an administrative group.
GroupAttributes	String	False		DelimitedData	An unused attribute associated with additional group-specific attributes.
GroupMembershipSAM	String	False		DelimitedData	Provides support for down-level Windows NT group membership functionality.
ControlAccessRights	String	False		DelimitedData	Specifies the access control rights for determining which users can perform specific operations on the group.
DesktopProfile	String	False		DelimitedData	Specifies the location of the desktop profile for a user or group of users. This attribute is no longer in use.
NonSecurityMember	String	False		DelimitedData	Specifies non-security members of the group, often used for Exchange distribution lists.
ManagedBy	String	False		DelimitedData	The Distinguished Name (DN) of the user assigned as the manager of this group object.
PrimaryGroupToken	String	False		DelimitedData	A computed attribute used to retrieve the membership list of certain groups, such as Domain Users. Membership lists are not explicitly stored for scalability.
Mail	String	False		DelimitedData	A list of email addresses associated with the group or its members.

Pseudo-Columns

Pseudo column fields are used in the WHERE clause of SELECT statements and offer a more granular control over the tuples that are returned from the data source.


Name	Type	Description
Filter	String	Defines an explicit LDAP filter that overrides other filter values set in the WHERE clause of the query.

OrganizationalPerson

Contains organizational details about a user, such as employee number, department, manager, job title, office address, and more. This class is commonly used for directory information systems.

Table Specific Information

Select

All columns support server-side processing for the operators =, >= , <=, !=, LIKE, AND, and OR. Other filters are executed client side within the Sync App. For example, the following query is processed by LDAP:

SELECT * FROM OrganizationalPerson WHERE  CN != 'NewUser' AND  BaseDN = 'CN=Users,DC=MyDC' LIMIT 5

Insert

To add a OrganizationalPerson, all fields can be specified except Id, DN, and BaseDN. Required fields that should be provided are RDN and ObjectClass. For example:

INSERT INTO OrganizationalPerson (RDN, ObjectClass) VALUES ('CN=NewUser', 'top;person;organizationalPerson;user;inetOrgPerson')

Update

All columns except Id, DN, and BaseDN can be updated by providing the Id in the WHERE clause. For example:

UPDATE OrganizationalPerson SET Description = 'desc' WHERE Id = '1|CN=NewUser,CN=Users,DC=MyDC'

Delete

OrganizationalPersons can be deleted by providing the Id of the OrganizationalPerson in a DELETE statement. For example:

DELETE FROM OrganizationalPerson WHERE Id = '1|CN=NewUser,CN=Users,DC=MyDC'

Columns


Name	Type	ReadOnly	References	DataFormat	Description
Id [KEY]	String	True			A combined index and Distinguished Name (DN). Multiple indices are allowed if the column is set to 'SplitDataByRow'.
DN	String	True			The full Distinguished Name (DN) representing the unique LDAP path of the object.
RDN	String	False			The Relative Distinguished Name (RDN), which is the unique portion of the DN within its parent container.
BaseDN	String	True			The base Distinguished Name (BaseDN) that specifies the starting point for LDAP operations.
ObjectClass	String	False		DelimitedData	The hierarchical list of LDAP object classes from which this object is derived.
SN	String	False		DelimitedData	Contains the user's surname or family name, such as 'Smith'.
CN	String	False		DelimitedData	Represents the common name of the object, used in LDAP searches. For example, 'John Doe'.
UserPassword	String	False		DelimitedData	Stores the user's password in UTF-8 format. This is a write-only attribute and cannot be retrieved for security reasons.
TelephoneNumber	String	False		DelimitedData	The primary telephone number associated with the user or object.
SeeAlso	String	False		DelimitedData	A list of Distinguished Names (DNs) that are related or linked to this object.
Description	String	False		DelimitedData	Contains a textual description of the object. It is typically single-valued but may be multi-valued depending on LDAP schema settings.
Title	String	False		DelimitedData	The user's formal job title, such as 'Senior Programmer', rather than occupational class, such as programmer. It does not include suffix titles like 'Esq.' or 'DDS'.
X121Address	String	False		DelimitedData	Specifies the X.121 address associated with the object, often used in telecommunications.
RegisteredAddress	String	False		DelimitedData	A mnemonic address associated with the object, registered in the relevant country or region for Public Telegram Service.
DestinationIndicator	String	False		DelimitedData	Part of the X.500 specification but not used in NTDS.
PreferredDeliveryMethod	String	False		DelimitedData	Defines the preferred method of delivery for communication with this object, as specified by the X.500 standard.
TelexNumber	String	False		DelimitedData	A list of alternate telex numbers associated with the object.
TeletexTerminalIdentifier	String	False		DelimitedData	Specifies the Teletex terminal identifier and optional parameters for a teletex terminal linked to the object.
InternationalISDNNumber	String	False		DelimitedData	Specifies an International ISDN (Integrated Services Digital Network) number associated with the object.
FacsimileTelephoneNumber	String	False		DelimitedData	Contains the fax machine telephone number associated with the user or organization.
Street	String	False		DelimitedData	Specifies the street address for the user or object.
PostOfficeBox	String	False		DelimitedData	Specifies the post office box number associated with the object.
PostalCode	String	False		DelimitedData	The postal or ZIP code used for mail delivery to the object.
PostalAddress	String	False		DelimitedData	The complete mailing address associated with the object.
PhysicalDeliveryOfficeName	String	False		DelimitedData	Specifies the office location within the user's place of business.
OU	String	False		DelimitedData	The name of the Organizational Unit (OU) to which the object belongs.
ST	String	False		DelimitedData	The name of the state or province associated with the user or object.
L	String	False		DelimitedData	Represents the name of a locality, such as a town or city, associated with the object.

Pseudo-Columns

Pseudo column fields are used in the WHERE clause of SELECT statements and offer a more granular control over the tuples that are returned from the data source.


Name	Type	Description
Filter	String	Defines an explicit LDAP filter, overriding other filters defined in the WHERE clause of the query.

Person

Stores personal information about a user, including general details such as name and contact information.

Table Specific Information

Select

All columns support server-side processing for the operators =, >= , <=, !=, LIKE, AND, and OR. Other filters are executed client side within the Sync App. For example, the following query is processed by LDAP:

SELECT * FROM Person WHERE  ObjectClass = 'top' AND  CN  LIKE '%NewUser%' LIMIT 5

Insert

To add a Person, all fields can be specified except Id, DN, and BaseDN. Required fields that should be provided are RDN and ObjectClass. For example:

INSERT INTO Person (RDN, ObjectClass) VALUES ('CN=Domain Admins', 'Person')

Update

All columns except Id, DN, and BaseDN can be updated by providing the Id in the WHERE clause. For example:

UPDATE Person SET Description = 'desc' WHERE Id = '1|CN=NewUser,CN=Users,DC=MyDC'

Delete

Person rows can be deleted by providing the Id of the Person in a DELETE statement. For example:

DELETE FROM Person WHERE Id = '1|CN=NewUser,CN=Users,DC=MyDC'

Columns


Name	Type	ReadOnly	References	DataFormat	Description
Id [KEY]	String	True			A combined index and Distinguished Name (DN). Multiple indices are supported if the column is set to 'SplitDataByRow'.
DN	String	True			The full Distinguished Name (DN) representing the unique LDAP path of the object.
RDN	String	False			The Relative Distinguished Name (RDN), which is the unique part of the DN within its parent container.
BaseDN	String	True			The base Distinguished Name (BaseDN) that specifies the starting point for LDAP operations.
ObjectClass_1	String	False		SplitDataByCol	The primary object class from which this entry is derived, defining its core attributes and behavior.
ObjectClass_2	String	False		SplitDataByCol	An additional object class from which this entry inherits attributes, defining extended behavior or properties.
ObjectClass_3	String	False		SplitDataByCol	An optional object class specifying further attributes or extended functionality for the entry.
ObjectClass_4	String	False		SplitDataByCol	An optional object class specifying additional attributes or properties for the entry.
SN	String	False		DelimitedData	Contains the user's surname or family name, such as 'Smith'.
CN	String	False		DelimitedData	Represents the common name of the object, often used in LDAP searches. For example, 'John Doe'.
UserPassword	String	False		DelimitedData	Stores the user's password in UTF-8 format. This is a write-only attribute and cannot be retrieved for security purposes.
TelephoneNumber	String	False		DelimitedData	The primary telephone number associated with the user or object.
SeeAlso	String	False		SplitDataByRow	A list of Distinguished Names (DNs) related to this object, establishing references to other LDAP entries.
Description	String	False		DelimitedData	Contains a textual description of the object. Typically single-valued but can be multi-valued depending on the LDAP schema.

Pseudo-Columns

Pseudo column fields are used in the WHERE clause of SELECT statements and offer a more granular control over the tuples that are returned from the data source.


Name	Type	Description
Filter	String	Defines an explicit LDAP filter, overriding other filters defined in the WHERE clause of the query.

Top

The root class from which all other LDAP classes are derived. It provides foundational attributes for other directory classes.

Table Specific Information

Select

All columns support server-side processing for the following operators =, >= , <=, !=, LIKE, AND, and OR. Other filters are executed client side within the Sync App. For example, the following query is processed by LDAP:

SELECT * FROM Top WHERE  CN != 'NewUser' AND  BaseDN = 'CN=Users,DC=MyDC' LIMIT 5

Insert

To add a Top record, all fields can be specified except Id, DN, and BaseDN. Required fields that should be provided are RDN and ObjectClass. For example:

INSERT INTO Top (RDN, ObjectClass) VALUES ('CN=NewUser', 'top;person;organizationalPerson;user;inetOrgPerson')

Update

All columns except Id, DN, and BaseDN can be updated by providing the Id in the WHERE clause. For example:

UPDATE Top SET Description = 'test' WHERE Id = '1|CN=NewUser,CN=Users,DC=MyDC'

Delete

Top records can be deleted by providing the Id of the Top record in a DELETE statement. For example:

DELETE FROM Top WHERE Id = '1|CN=NewUser,CN=Users,DC=MyDC'

Columns


Name	Type	ReadOnly	References	DataFormat	Description
Id [KEY]	String	True			A combined index and Distinguished Name (DN). Multiple indices are supported if the column is set to 'SplitDataByRow'.
DN	String	True			The full Distinguished Name (DN) that represents the unique LDAP path of the object.
RDN	String	False			The Relative Distinguished Name (RDN), which is the unique part of the DN within its parent container.
BaseDN	String	True			The base Distinguished Name (BaseDN) that specifies the starting point for LDAP operations.
ObjectClass	String	False		DelimitedData	The hierarchical list of LDAP object classes from which this object is derived, defining its attributes and behavior.
SN	String	False		DelimitedData	Contains the user's surname or family name, such as 'Smith'.
CN	String	False		DelimitedData	Represents the common name of the object, often used for LDAP searches. For example, 'John Doe'.
GroupType	String	False		DelimitedData	Defines a set of flags indicating the type and scope of the group object. For example, it identifies whether it is a security or distribution group.
MemberOf	String	False		DelimitedData	Specifies the Distinguished Names (DNs) of the groups to which this object belongs. This establishes group membership relationships.
DC	String	False		DelimitedData	Specifies the Domain Component (DC) attribute for the Domain object class, used to identify the domain.

Pseudo-Columns

Pseudo column fields are used in the WHERE clause of SELECT statements and offer a more granular control over the tuples that are returned from the data source.


Name	Type	Description
Filter	String	Defines an explicit LDAP filter that overrides any other filter values set in the WHERE clause of the query.

User

Stores information about employees, contractors, or long-term visitors in an organization. Includes attributes such as name, contact details, and job-related information.

Table Specific Information

Select

All columns support server-side processing for the operators =, >= , <=, !=, LIKE, AND, and OR. Other filters are executed client side within the Sync App. For example, the following query is processed by LDAP:

SELECT * FROM User WHERE  Title LIKE '%abc%' AND  AdminCount != '1' LIMIT 5

Insert

To add a User, all fields can be specified except Id, DN, and BaseDN. Required fields that should be provided are RDN and ObjectClass. For example:

INSERT INTO [User] (RDN, ObjectClass) VALUES ('CN=TestUser', 'Top; Person; OrganizationalPerson; User')

Update

All columns except Id, DN, and BaseDN can be updated by providing the Id in the WHERE clause. For example:

UPDATE User SET PostalCode = '94042' WHERE Id = '1|CN=NewUser,CN=Users,DC=MyDC'

Delete

Users can be deleted by providing the Id of the User in a DELETE statement. For example:

DELETE FROM User WHERE Id = '1|CN=NewUser,CN=Users,DC=MyDC'

Columns


Name	Type	ReadOnly	References	DataFormat	Description
Id [KEY]	String	True			A combined index and Distinguished Name (DN). Multiple indices are supported when the column is set to 'SplitDataByRow'.
DN	String	True			The full Distinguished Name (DN) that uniquely identifies the object in the LDAP directory.
RDN	String	False			The Relative Distinguished Name (RDN), which is the unique portion of the DN within its parent container.
BaseDN	String	True			The base Distinguished Name (BaseDN) that specifies the starting point for LDAP operations.
ObjectClass	String	False		DelimitedData	A list of LDAP object classes that define the attributes and behavior of this object.
SN	String	False		DelimitedData	The surname or family name of the user, such as 'Smith'.
CN	String	False		DelimitedData	The common name of the object, used for identification and searches. For example, 'John Doe'.
UserPassword	String	False		DelimitedData	The user's password stored in UTF-8 format. This is a write-only attribute for security purposes.
TelephoneNumber	String	False		DelimitedData	The primary telephone number associated with the user or object.
SeeAlso	String	False		DelimitedData	A list of Distinguished Names (DNs) of objects that are related or linked to this one.
Description	String	False		DelimitedData	A textual description of the object. This attribute can be single-valued or multi-valued depending on compatibility requirements.
Title	String	False		DelimitedData	The user's formal job title, such as 'Senior Programmer', rather than occupational class, such as programmer. This does not include suffix titles like 'Esq.' or 'DDS'.
X121Address	String	False		DelimitedData	The X.121 address associated with the object, often used in telecommunications.
RegisteredAddress	String	False		DelimitedData	A mnemonic address associated with a specific city, registered in the relevant country or region.
DestinationIndicator	String	False		DelimitedData	An X.500 attribute that is not used in modern NTDS implementations.
PreferredDeliveryMethod	String	False		DelimitedData	The X.500-preferred method for delivering messages to the addressee.
TelexNumber	String	False		DelimitedData	A list of alternate telex numbers associated with the user or object.
TeletexTerminalIdentifier	String	False		DelimitedData	Specifies the Teletex terminal identifier and optional parameters for a teletex terminal linked to this object.
InternationalISDNNumber	String	False		DelimitedData	The International ISDN (Integrated Services Digital Network) number associated with the object.
FacsimileTelephoneNumber	String	False		DelimitedData	The telephone number of the user's business fax machine.
Street	String	False		DelimitedData	The street address of the user or object.
PostOfficeBox	String	False		DelimitedData	The post office box number associated with the user or object.
PostalCode	String	False		DelimitedData	The postal or ZIP code used for mail delivery to the user or object.
PostalAddress	String	False		DelimitedData	The complete mailing address of the user or object.
PhysicalDeliveryOfficeName	String	False		DelimitedData	The name or location of the user's office within their place of business.
OU	String	False		DelimitedData	The name of the Organizational Unit (OU) to which the user or object belongs.
ST	String	False		DelimitedData	The state or province associated with the user or object.
L	String	False		DelimitedData	The locality, such as a city or town, associated with the user or object.
UserCertificate	String	False		DelimitedData	A DER-encoded X.509v3 certificate issued to the user, including public key certificates provided by Microsoft Certificate Services.
NetworkAddress	String	False		DelimitedData	The TCP/IP address for a network segment, also referred to as the subnet address.
UserAccountControl	String	False		DelimitedData	Flags that define the behavior and access control of the user account.
BadPwdCount	String	False		DelimitedData	The number of failed login attempts for this account. A value of 0 indicates that the count is unknown.
CodePage	String	False		DelimitedData	Specifies the code page for the user's preferred language. This attribute is not used in modern Windows implementations.
HomeDirectory	String	False		DelimitedData	The home directory for the account. If 'homeDrive' specifies a drive letter, 'homeDirectory' must be a UNC path. Otherwise, it is a local path, including the drive letter (e.g., 'C:\Directory\Folder').
HomeDrive	String	False		DelimitedData	The drive letter to map to the UNC path specified in 'homeDirectory'. Must be in the format 'DriveLetter:', where 'DriveLetter' is an uppercase letter.
BadPasswordTime	Datetime	False		DelimitedData	The last date and time a failed login attempt was made using an incorrect password. Stored as a large integer representing the number of 100-nanosecond intervals since January 1, 1601 (UTC). A value of 0 indicates no record of failed attempts.
LastLogoff	String	False		DelimitedData	This attribute is not currently used in modern implementations.
LastLogon	Datetime	False		DelimitedData	The last time the user successfully logged on. Stored as a large integer representing the number of 100-nanosecond intervals since January 1, 1601 (UTC). A value of 0 indicates no record of login.
DBCSPwd	String	False		DelimitedData	The LAN Manager password of the account. Used primarily for backward compatibility.
LocaleID	String	False		DelimitedData	A list of locale IDs representing the language and geographic preferences for the user.
ScriptPath	String	False		DelimitedData	The path to the user's login script. Can be null.
LogonHours	String	False		DelimitedData	Specifies the hours during which the user is allowed to log on to the domain.
LogonWorkstation	String	False		DelimitedData	Not used in modern implementations. Refer to the User-Workstations attribute instead.
MaxStorage	String	False		DelimitedData	Defines the maximum disk space the user can use. Use 'USER_MAXSTORAGE_UNLIMITED' to allow unlimited space.
UserWorkstations	String	False		DelimitedData	Lists the NetBIOS or DNS names of the computers from which the user can log on. Multiple names are separated by commas.
UnicodePwd	String	False		DelimitedData	The user's password stored in Windows NT one-way format (OWF). This is managed by the operating system, and the original password cannot be derived.
OtherLoginWorkstations	String	False		DelimitedData	Specifies non-Windows NT or LAN Manager workstations from which the user can log on.
NtPwdHistory	String	False		DelimitedData	The user's password history stored in Windows NT one-way format (OWF).
PwdLastSet	Datetime	False		DelimitedData	The date and time when the user's password was last changed. Stored as a large integer representing 100-nanosecond intervals since January 1, 1601 (UTC). A value of 0 indicates that the user must set a password at next login.
PreferredOU	String	False		DelimitedData	The Organizational Unit (OU) that is displayed by default on the user's desktop.
PrimaryGroupID	String	False		DelimitedData	The Relative Identifier (RID) for the user's primary group, typically the Domain Users group.
UserParameters	String	False		DelimitedData	A Unicode string reserved for application-specific user data. Can be null or contain any character string.
ProfilePath	String	False		DelimitedData	The path to the user's profile. This value can be a null string, a local absolute path, or a UNC path.
OperatorCount	String	False		DelimitedData	Tracks the number of operators assigned to the user.
AdminCount	String	False		DelimitedData	Indicates whether the system has adjusted the ACLs of the object for higher security due to membership in an administrative group.
AccountExpires	Datetime	False		DelimitedData	The date when the account expires. Stored as a large integer representing 100-nanosecond intervals since January 1, 1601 (UTC). A value of 0 or 0x7FFFFFFFFFFFFFFF indicates the account does not expire.
LmPwdHistory	String	False		DelimitedData	The password history of the user in LAN Manager (LM) format. Used for backward compatibility.
GroupMembershipSAM	String	False		DelimitedData	Provides support for down-level Windows NT group membership functionality.
LogonCount	String	False		DelimitedData	The number of successful logons for the account. A value of 0 indicates no record of successful logons.
ControlAccessRights	String	False		DelimitedData	Defines the specific rights required for users to perform operations on this object.
DefaultClassStore	String	False		DelimitedData	Specifies the default Class Store associated with the user.
GroupsToIgnore	String	False		DelimitedData	An attribute that is not currently used and has no functional effect.
GroupPriority	String	False		DelimitedData	An unused attribute associated with group priority.
DesktopProfile	String	False		DelimitedData	Specifies the desktop profile location for a user or group of users. This attribute is not currently used.
DynamicLDAPServer	String	False		DelimitedData	The DNS name of the server responsible for dynamic properties of this account.
UserPrincipalName	String	False		DelimitedData	An Internet-style login name for the user, based on RFC 822 standards. Typically maps to the user's email address for convenience. For more information about this attribute, see User Naming Attributes.
LockoutTime	Datetime	False		DelimitedData	The date and time (UTC) when the account was locked out. Stored as a large integer representing 100-nanosecond intervals since January 1, 1601 (UTC). A value of 0 indicates the account is not locked out.
UserSharedFolder	String	False		DelimitedData	Specifies a UNC path to the user's shared documents folder. The path must be a network UNC path of the form \\Server\Share\Directory. This value can be a null string.
UserSharedFolderOther	String	False		DelimitedData	Specifies an additional UNC path to the user's shared documents folder. The path must be a network UNC path of the form \\Server\Share\Directory. This value can be a null string.
ServicePrincipalName	String	False		DelimitedData	Lists the Service Principal Names (SPNs) used for mutual authentication with services on this computer.
ACSPolicyName	String	False		DelimitedData	Specifies the name of the ACS (Access Control System) policy that applies to the user.
TerminalServer	String	False		DelimitedData	Contains data used by the Windows NT Terminal Server. Not user-editable.
MSMQSignCertificates	String	False		DelimitedData	A collection of certificates issued to the user for Microsoft Message Queuing (MSMQ). Includes a digest for each certificate.
MSMQDigests	String	False		DelimitedData	An array of digests corresponding to the certificates in the MSMQSignCertificates attribute, used for certificate mapping.
MSMQDigestsMig	String	False		DelimitedData	In MSMQ mixed-mode, stores the previous value of the MSMQDigests attribute.
MSMQSignCertificatesMig	String	False		DelimitedData	In MSMQ mixed-mode, stores the previous value of the MSMQSignCertificates attribute.
MsNPAllowDialin	String	False		DelimitedData	Indicates whether the account is allowed to dial in to a RAS server. This value should be managed through RAS administration tools.
MsNPCallingStationID	String	False		DelimitedData	An attribute used internally for RAS. Do not modify directly.
MsNPSavedCallingStationID	String	False		DelimitedData	Stores the saved RAS calling station ID. This attribute is used internally and should not be modified directly.
MsRADIUSCallbackNumber	String	False		DelimitedData	The callback number used for RADIUS. This attribute is managed internally.
MsRADIUSFramedIPAddress	String	False		DelimitedData	Specifies the framed IP address for RADIUS. Managed internally.
MsRADIUSFramedRoute	String	False		DelimitedData	Defines the framed route for RADIUS. Managed internally.
MsRADIUSServiceType	String	False		DelimitedData	Indicates the RADIUS service type. Managed internally.
MsRASSavedCallbackNumber	String	False		DelimitedData	The saved RADIUS callback number. Managed internally.
MsRASSavedFramedIPAddress	String	False		DelimitedData	The saved RADIUS framed IP address. Managed internally.
MsRASSavedFramedRoute	String	False		DelimitedData	The saved RADIUS framed route. Managed internally.
MS-DS-CreatorSID	String	False		DelimitedData	The Security Identifier (SID) of the creator of the object containing this attribute.

Pseudo-Columns

Pseudo column fields are used in the WHERE clause of SELECT statements and offer a more granular control over the tuples that are returned from the data source.


Name	Type	Description
Filter	String	Defines an explicit LDAP filter that overrides any other filter specified in the WHERE clause.

Connection String Options

The connection string properties are the various options that can be used to establish a connection. This section provides a complete list of the options you can configure in the connection string for this provider. Click the links for further details.

For more information on establishing a connection, see Establishing a Connection.

Authentication

Property	Description
Server	Specifies the domain name or IP address of the LDAP server. This property is required to establish a connection and does not need to include the LDAP:\\\\ prefix, only the server’s domain name or IP address.
Port	Specifies the port number on which the LDAP server is running.
User	Specifies the distinguished name (DN) of the user account to be used for authentication with the LDAP server. This property is required when the server enforces authentication.
Password	Specifies the password associated with the distinguished name (DN) of the user account used for authentication with the LDAP server. This property is required when the server enforces authentication.
BaseDN	Specifies the base portion of the distinguished name (DN) to limit LDAP queries to a specific subtree within the directory. Using a base DN helps narrow the search scope and improve query performance, especially on large LDAP servers.
UseSSL	Specifies whether SSL is used to secure the connection to the LDAP server. Enabling this property ensures that communication between the client and server is encrypted.
LDAPVersion	Specifies the version of the LDAP protocol to use when connecting to the server. The supported values are 2 and 3.
AuthMechanism	Specifies the authentication mechanism to use when connecting to the LDAP server. Supported values are SIMPLE for plaintext authentication and NEGOTIATE for NTLM/Negotiate authentication.
Scope	Specifies the scope of the LDAP search. This property defines whether the search applies to the entire subtree (BaseDN and all its descendants), a single level (BaseDN and its direct descendants), or just the base object (BaseDN only).
DNAttributeFilter	Specifies whether to use distinguishedName or entryDN as the DN attribute in LDAP query filters. This property affects how the distinguished name is referenced during search operations.

SSL

Property	Description
SSLServerCert	Specifies the certificate to be accepted from the server when connecting using TLS/SSL.

Firewall

Property	Description
FirewallType	Specifies the protocol the provider uses to tunnel traffic through a proxy-based firewall.
FirewallServer	Identifies the IP address, DNS name, or host name of a proxy used to traverse a firewall and relay user queries to network resources.
FirewallPort	Specifies the TCP port to be used for a proxy-based firewall.
FirewallUser	Identifies the user ID of the account authenticating to a proxy-based firewall.
FirewallPassword	Specifies the password of the user account authenticating to a proxy-based firewall.

Logging

Property	Description
LogModules	Specifies the core modules to include in the log file. Use a semicolon-separated list of module names. By default, all modules are logged.

Schema

Property	Description
Location	Specifies the location of a directory containing schema files that define tables, views, and stored procedures. Depending on your service's requirements, this may be expressed as either an absolute path or a relative path.
BrowsableSchemas	Optional setting that restricts the schemas reported to a subset of all available schemas. For example, BrowsableSchemas=SchemaA,SchemaB,SchemaC .
Tables	Optional setting that restricts the tables reported to a subset of all available tables. For example, Tables=TableA,TableB,TableC .
Views	Optional setting that restricts the views reported to a subset of the available tables. For example, Views=ViewA,ViewB,ViewC .

Miscellaneous

Property	Description
FollowReferrals	Specifies whether to follow LDAP referrals returned by the LDAP server. When enabled, the provider retrieves data from the referred servers instead of the original server.
FriendlyGUID	Specifies whether GUID attributes, such as objectGUID, are returned in a human-readable string format or as base64-encoded binary objects. When enabled, the property converts GUIDs into a friendly string format.
FriendlySID	Specifies whether SID attributes, such as objectSid, are returned in a human-readable string format or as base64-encoded binary objects. When enabled, the property converts SIDs into a friendly string format.
MaxRows	Specifies the maximum rows returned for queries without aggregation or GROUP BY.
Other	Specifies additional hidden properties for specific use cases. These are not required for typical provider functionality. Use a semicolon-separated list to define multiple properties.
PseudoColumns	Specifies the pseudocolumns to expose as table columns. Use the format 'TableName=ColumnName;TableName=ColumnName'. The default is an empty string, which disables this property.
Timeout	Specifies the maximum time, in seconds, that the provider waits for a server response before throwing a timeout error. The default is 60 seconds. Set to 0 to disable the timeout.
UserDefinedViews	Specifies a filepath to a JSON configuration file defining custom views. The provider automatically detects and uses the views specified in this file.

Authentication

This section provides a complete list of the Authentication properties you can configure in the connection string for this provider.

Property	Description
Server	Specifies the domain name or IP address of the LDAP server. This property is required to establish a connection and does not need to include the LDAP:\\\\ prefix, only the server’s domain name or IP address.
Port	Specifies the port number on which the LDAP server is running.
User	Specifies the distinguished name (DN) of the user account to be used for authentication with the LDAP server. This property is required when the server enforces authentication.
Password	Specifies the password associated with the distinguished name (DN) of the user account used for authentication with the LDAP server. This property is required when the server enforces authentication.
BaseDN	Specifies the base portion of the distinguished name (DN) to limit LDAP queries to a specific subtree within the directory. Using a base DN helps narrow the search scope and improve query performance, especially on large LDAP servers.
UseSSL	Specifies whether SSL is used to secure the connection to the LDAP server. Enabling this property ensures that communication between the client and server is encrypted.
LDAPVersion	Specifies the version of the LDAP protocol to use when connecting to the server. The supported values are 2 and 3.
AuthMechanism	Specifies the authentication mechanism to use when connecting to the LDAP server. Supported values are SIMPLE for plaintext authentication and NEGOTIATE for NTLM/Negotiate authentication.
Scope	Specifies the scope of the LDAP search. This property defines whether the search applies to the entire subtree (BaseDN and all its descendants), a single level (BaseDN and its direct descendants), or just the base object (BaseDN only).
DNAttributeFilter	Specifies whether to use distinguishedName or entryDN as the DN attribute in LDAP query filters. This property affects how the distinguished name is referenced during search operations.

Server

Specifies the domain name or IP address of the LDAP server. This property is required to establish a connection and does not need to include the LDAP:\\\\ prefix, only the server’s domain name or IP address.

Remarks

This property defines the LDAP server's location and must be set to either a domain name like "ldap.example.com" or an IP address such as 192.168.1.1. Do not include the LDAP:\\ prefix, as the provider handles it automatically.

Port

Specifies the port number on which the LDAP server is running.

Remarks

This property defines the port the LDAP server is running on. By default, it is set to 389, which is the standard port for LDAP. Together with the Server property, this property determines the full connection endpoint. If your LDAP server is configured to use a non-standard port, update this property accordingly.

User

Specifies the distinguished name (DN) of the user account to be used for authentication with the LDAP server. This property is required when the server enforces authentication.

Remarks

This property is used, along with the Password property, to authenticate against the LDAP server. The value must be the full distinguished name (DN) of the user account, such as "CN=John Doe,OU=Users,DC=example,DC=com". Ensure the value matches the DN format expected by the LDAP server to avoid authentication failures.

Password

Specifies the password associated with the distinguished name (DN) of the user account used for authentication with the LDAP server. This property is required when the server enforces authentication.

Remarks

This property is used in conjunction with the User property to authenticate against the LDAP server. Ensure the password corresponds to the specified distinguished name (DN) to avoid authentication failures. For enhanced security, ensure the password is not hardcoded in configuration files. Instead, use environment variables or secure credential storage to handle sensitive values when configuring LDAP authentication.

BaseDN

Specifies the base portion of the distinguished name (DN) to limit LDAP queries to a specific subtree within the directory. Using a base DN helps narrow the search scope and improve query performance, especially on large LDAP servers.

Remarks

This property sets the starting point for LDAP searches by specifying the base DN. By limiting the search to a specific subtree, the number of entries examined is significantly reduced, which can greatly improve performance on large servers. The value should be a valid DN, such as "DC=example,DC=com", that represents the desired subtree. If left blank, the search scope is not restricted and applies to the entire directory.

UseSSL

Specifies whether SSL is used to secure the connection to the LDAP server. Enabling this property ensures that communication between the client and server is encrypted.

Remarks

This property specifies whether the connection to the LDAP server should be encrypted using SSL. If set to true, SSL is used to secure the connection. By default, this property is set to false, meaning SSL is not enforced.

However, note the following about LDAP standard ports:

Port 636: This port is always encrypted as it is the standard LDAP SSL port. SSL is automatically applied when this port is used, even if this property is set to false.
Port 389: This port is typically used for unencrypted connections.

If the Sync App connects to an encrypted endpoint, SSL is automatically used regardless of the value of this property. Ensure that your LDAP server supports SSL if you enable this property.

LDAPVersion

Specifies the version of the LDAP protocol to use when connecting to the server. The supported values are 2 and 3.

Remarks

Set this property to specify the LDAP protocol version used for communication. The default value is 2, but many modern LDAP servers require version 3 for compatibility. Ensure that the server you are connecting to supports the specified version to avoid communication errors. The provider complies with LDAP standards as specified in RFC 1777, RFC 2251, and other relevant LDAP RFCs.

AuthMechanism

Specifies the authentication mechanism to use when connecting to the LDAP server. Supported values are SIMPLE for plaintext authentication and NEGOTIATE for NTLM/Negotiate authentication.

Remarks

This property specifies the method of authentication to use during connection. The default value is SIMPLE, which uses plaintext credentials to authenticate with the server. If set to NEGOTIATE, NTLM/Negotiate authentication is used, enabling support for Windows-based integrated authentication. Ensure the LDAP server supports the specified authentication mechanism. Use NEGOTIATE for environments that require secure, integrated authentication, while SIMPLE is suitable for scenarios where plaintext credentials are accepted.

Scope

Specifies the scope of the LDAP search. This property defines whether the search applies to the entire subtree (BaseDN and all its descendants), a single level (BaseDN and its direct descendants), or just the base object (BaseDN only).

Remarks

This property is useful for balancing performance and query results. For broad searches that require retrieving entries across the entire directory hierarchy, use WHOLESUBTREE. For more focused queries, select SINGLELEVEL to limit results to the BaseDN’s direct descendants or BASEOBJECT to retrieve only the BaseDN itself. Narrowing the search scope can help reduce unnecessary overhead and improve query efficiency, especially in large directories.

WHOLESUBTREE (Default): Searches the BaseDN and all of its descendants.
SINGLELEVEL: Searches only the BaseDN and its direct descendants.
BASEOBJECT: Searches only the BaseDN itself, without including any descendants.

DNAttributeFilter

Specifies whether to use distinguishedName or entryDN as the DN attribute in LDAP query filters. This property affects how the distinguished name is referenced during search operations.

Remarks

This property is useful for specifying how the DN is handled in filters for LDAP queries. The default value is distinguishedName, which is widely used in most LDAP servers. For servers or configurations that rely on entryDN for DN filtering, update this property accordingly. Ensure that the chosen attribute is supported by your LDAP server to avoid query errors.

SSL

This section provides a complete list of the SSL properties you can configure in the connection string for this provider.

Property	Description
SSLServerCert	Specifies the certificate to be accepted from the server when connecting using TLS/SSL.

SSLServerCert

Specifies the certificate to be accepted from the server when connecting using TLS/SSL.

Remarks

If using a TLS/SSL connection, this property can be used to specify the TLS/SSL certificate to be accepted from the server. Any other certificate that is not trusted by the machine is rejected.

This property can take the following forms:


Description	Example
A full PEM Certificate (example shortened for brevity)	-----BEGIN CERTIFICATE----- MIIChTCCAe4CAQAwDQYJKoZIhv......Qw== -----END CERTIFICATE-----
A path to a local file containing the certificate	C:\cert.cer
The public key (example shortened for brevity)	-----BEGIN RSA PUBLIC KEY----- MIGfMA0GCSq......AQAB -----END RSA PUBLIC KEY-----
The MD5 Thumbprint (hex values can also be either space or colon separated)	ecadbdda5a1529c58a1e9e09828d70e4
The SHA1 Thumbprint (hex values can also be either space or colon separated)	34a929226ae0819f2ec14b4a3d904f801cbb150d

If not specified, any certificate trusted by the machine is accepted.

Use '*' to signify to accept all certificates. Note that this is not recommended due to security concerns.

Firewall

This section provides a complete list of the Firewall properties you can configure in the connection string for this provider.

Property	Description
FirewallType	Specifies the protocol the provider uses to tunnel traffic through a proxy-based firewall.
FirewallServer	Identifies the IP address, DNS name, or host name of a proxy used to traverse a firewall and relay user queries to network resources.
FirewallPort	Specifies the TCP port to be used for a proxy-based firewall.
FirewallUser	Identifies the user ID of the account authenticating to a proxy-based firewall.
FirewallPassword	Specifies the password of the user account authenticating to a proxy-based firewall.

FirewallType

Specifies the protocol the provider uses to tunnel traffic through a proxy-based firewall.

Remarks

A proxy-based firewall (or proxy firewall) is a network security device that acts as an intermediary between user requests and the resources they access. The proxy accepts the request of an authenticated user, tunnels through the firewall, and transmits the request to the appropriate server.

Because the proxy evaluates and transfers data backets on behalf of the requesting users, the users never connect directly with the servers, only with the proxy.

The following table provides port number information for each of the supported protocols.


Protocol	Default Port	Description
TUNNEL	80	The port where the Sync App opens a connection to LDAP. Traffic flows back and forth via the proxy at this location.
SOCKS4	1080	The port where the Sync App opens a connection to LDAP. SOCKS 4 then passes theFirewallUser value to the proxy, which determines whether the connection request should be granted.
SOCKS5	1080	The port where the Sync App sends data to LDAP. If the SOCKS 5 proxy requires authentication, set FirewallUser and FirewallPassword to credentials the proxy recognizes.

FirewallServer

Identifies the IP address, DNS name, or host name of a proxy used to traverse a firewall and relay user queries to network resources.

Remarks

A proxy-based firewall (or proxy firewall) is a network security device that acts as an intermediary between user requests and the resources they access. The proxy accepts the request of an authenticated user, tunnels through the firewall, and transmits the request to the appropriate server.

Because the proxy evaluates and transfers data backets on behalf of the requesting users, the users never connect directly with the servers, only with the proxy.

FirewallPort

Specifies the TCP port to be used for a proxy-based firewall.

Remarks

A proxy-based firewall (or proxy firewall) is a network security device that acts as an intermediary between user requests and the resources they access. The proxy accepts the request of an authenticated user, tunnels through the firewall, and transmits the request to the appropriate server.

Because the proxy evaluates and transfers data backets on behalf of the requesting users, the users never connect directly with the servers, only with the proxy.

FirewallUser

Identifies the user ID of the account authenticating to a proxy-based firewall.

Remarks

A proxy-based firewall (or proxy firewall) is a network security device that acts as an intermediary between user requests and the resources they access. The proxy accepts the request of an authenticated user, tunnels through the firewall, and transmits the request to the appropriate server.

Because the proxy evaluates and transfers data backets on behalf of the requesting users, the users never connect directly with the servers, only with the proxy.

FirewallPassword

Specifies the password of the user account authenticating to a proxy-based firewall.

Remarks

A proxy-based firewall (or proxy firewall) is a network security device that acts as an intermediary between user requests and the resources they access. The proxy accepts the request of an authenticated user, tunnels through the firewall, and transmits the request to the appropriate server.

Because the proxy evaluates and transfers data backets on behalf of the requesting users, the users never connect directly with the servers, only with the proxy.

Logging

This section provides a complete list of the Logging properties you can configure in the connection string for this provider.

Property	Description
LogModules	Specifies the core modules to include in the log file. Use a semicolon-separated list of module names. By default, all modules are logged.

LogModules

Specifies the core modules to include in the log file. Use a semicolon-separated list of module names. By default, all modules are logged.

Remarks

This property lets you customize the log file content by specifying the logging modules to include. Logging modules categorize logged information into distinct areas, such as query execution, metadata, or SSL communication. Each module is represented by a four-character code, with some requiring a trailing space for three-letter names.

For example, EXEC logs query execution, and INFO logs general provider messages. To include multiple modules, separate their names with semicolons as follows: INFO;EXEC;SSL.

The Verbosity connection property takes precedence over the module-based filtering specified by this property. Only log entries that meet the verbosity level and belong to the specified modules are logged. Leave this property blank to include all available modules in the log file.

For a complete list of available modules and detailed guidance on configuring logging, refer to the Advanced Logging section in Logging.

Schema

This section provides a complete list of the Schema properties you can configure in the connection string for this provider.

Property	Description
Location	Specifies the location of a directory containing schema files that define tables, views, and stored procedures. Depending on your service's requirements, this may be expressed as either an absolute path or a relative path.
BrowsableSchemas	Optional setting that restricts the schemas reported to a subset of all available schemas. For example, BrowsableSchemas=SchemaA,SchemaB,SchemaC .
Tables	Optional setting that restricts the tables reported to a subset of all available tables. For example, Tables=TableA,TableB,TableC .
Views	Optional setting that restricts the views reported to a subset of the available tables. For example, Views=ViewA,ViewB,ViewC .

Location

Specifies the location of a directory containing schema files that define tables, views, and stored procedures. Depending on your service's requirements, this may be expressed as either an absolute path or a relative path.

Remarks

The Location property is only needed if you want to either customize definitions (for example, change a column name, ignore a column, etc.) or extend the data model with new tables, views, or stored procedures.

If left unspecified, the default location is %APPDATA%\\CData\\LDAP Data Provider\\Schema, where %APPDATA% is set to the user's configuration directory:


Platform	%APPDATA%
Windows	The value of the APPDATA environment variable
Linux	~/.config

BrowsableSchemas

Optional setting that restricts the schemas reported to a subset of all available schemas. For example, BrowsableSchemas=SchemaA,SchemaB,SchemaC .

Remarks

Listing all available database schemas can take extra time, thus degrading performance. Providing a list of schemas in the connection string saves time and improves performance.

Tables

Optional setting that restricts the tables reported to a subset of all available tables. For example, Tables=TableA,TableB,TableC .

Remarks

Listing all available tables from some databases can take extra time, thus degrading performance. Providing a list of tables in the connection string saves time and improves performance.

If there are lots of tables available and you already know which ones you want to work with, you can use this property to restrict your viewing to only those tables. To do this, specify the tables you want in a comma-separated list. Each table should be a valid SQL identifier with any special characters escaped using square brackets, double-quotes or backticks. For example, Tables=TableA,[TableB/WithSlash],WithCatalog.WithSchema.`TableC With Space`.

Note: If you are connecting to a data source with multiple schemas or catalogs, you must specify each table you want to view by its fully qualified name. This avoids ambiguity between tables that may exist in multiple catalogs or schemas.

Views

Optional setting that restricts the views reported to a subset of the available tables. For example, Views=ViewA,ViewB,ViewC .

Remarks

Listing all available views from some databases can take extra time, thus degrading performance. Providing a list of views in the connection string saves time and improves performance.

If there are lots of views available and you already know which ones you want to work with, you can use this property to restrict your viewing to only those views. To do this, specify the views you want in a comma-separated list. Each view should be a valid SQL identifier with any special characters escaped using square brackets, double-quotes or backticks. For example, Views=ViewA,[ViewB/WithSlash],WithCatalog.WithSchema.`ViewC With Space`.

Note: If you are connecting to a data source with multiple schemas or catalogs, you must specify each view you want to examine by its fully qualified name. This avoids ambiguity between views that may exist in multiple catalogs or schemas.

Miscellaneous

This section provides a complete list of the Miscellaneous properties you can configure in the connection string for this provider.

Property	Description
FollowReferrals	Specifies whether to follow LDAP referrals returned by the LDAP server. When enabled, the provider retrieves data from the referred servers instead of the original server.
FriendlyGUID	Specifies whether GUID attributes, such as objectGUID, are returned in a human-readable string format or as base64-encoded binary objects. When enabled, the property converts GUIDs into a friendly string format.
FriendlySID	Specifies whether SID attributes, such as objectSid, are returned in a human-readable string format or as base64-encoded binary objects. When enabled, the property converts SIDs into a friendly string format.
MaxRows	Specifies the maximum rows returned for queries without aggregation or GROUP BY.
Other	Specifies additional hidden properties for specific use cases. These are not required for typical provider functionality. Use a semicolon-separated list to define multiple properties.
PseudoColumns	Specifies the pseudocolumns to expose as table columns. Use the format 'TableName=ColumnName;TableName=ColumnName'. The default is an empty string, which disables this property.
Timeout	Specifies the maximum time, in seconds, that the provider waits for a server response before throwing a timeout error. The default is 60 seconds. Set to 0 to disable the timeout.
UserDefinedViews	Specifies a filepath to a JSON configuration file defining custom views. The provider automatically detects and uses the views specified in this file.

FollowReferrals

Specifies whether to follow LDAP referrals returned by the LDAP server. When enabled, the provider retrieves data from the referred servers instead of the original server.

Remarks

This property specifies whether the provider should follow referrals returned by the LDAP server during queries. Referrals are pointers to other LDAP servers that may contain the requested data. When FollowReferrals is set to true, the provider connects to the referral servers to retrieve data. Note that data operations such as INSERT, UPDATE, or DELETE cannot be performed on referral servers unless the connection string is updated to connect directly to those servers.

FriendlyGUID

Specifies whether GUID attributes, such as objectGUID, are returned in a human-readable string format or as base64-encoded binary objects. When enabled, the property converts GUIDs into a friendly string format.

Remarks

This property specifies how GUID attributes, such as objectGUID, are returned when inspecting object attributes. If set to true, GUIDs are converted into a human-readable string format. If set to false, GUIDs are returned as base64-encoded binary objects. The friendly string format makes GUID values easier to interpret and work with during debugging or when creating readable reports. This property is useful in scenarios where GUIDs need to be reviewed manually or shared in a clear, human-readable format.

FriendlySID

Specifies whether SID attributes, such as objectSid, are returned in a human-readable string format or as base64-encoded binary objects. When enabled, the property converts SIDs into a friendly string format.

Remarks

This property specifies how SID attributes, such as objectSid, are returned when inspecting object attributes. If set to true, SIDs are converted into a human-readable string format. If set to false, SIDs are returned as base64-encoded binary objects. The friendly string format simplifies working with SID values, making them easier to interpret during debugging or when generating reports. This property is useful in scenarios where SIDs need to be reviewed manually or shared in a clear, human-readable format.

MaxRows

Specifies the maximum rows returned for queries without aggregation or GROUP BY.

Remarks

This property sets an upper limit on the number of rows the Sync App returns for queries that do not include aggregation or GROUP BY clauses. This limit ensures that queries do not return excessively large result sets by default.

When a query includes a LIMIT clause, the value specified in the query takes precedence over the MaxRows setting. If MaxRows is set to "-1", no row limit is enforced unless a LIMIT clause is explicitly included in the query.

This property is useful for optimizing performance and preventing excessive resource consumption when executing queries that could otherwise return very large datasets.

Other

Specifies additional hidden properties for specific use cases. These are not required for typical provider functionality. Use a semicolon-separated list to define multiple properties.

Remarks

This property allows advanced users to configure hidden properties for specialized scenarios. These settings are not required for normal use cases but can address unique requirements or provide additional functionality. Multiple properties can be defined in a semicolon-separated list.

Note: It is strongly recommended to set these properties only when advised by the support team to address specific scenarios or issues.

Specify multiple properties in a semicolon-separated list.

Integration and Formatting


DefaultColumnSize	Sets the default length of string fields when the data source does not provide column length in the metadata. The default value is 2000.
ConvertDateTimeToGMT	Determines whether to convert date-time values to GMT, instead of the local time of the machine.
RecordToFile=filename	Records the underlying socket data transfer to the specified file.

PseudoColumns

Specifies the pseudocolumns to expose as table columns. Use the format 'TableName=ColumnName;TableName=ColumnName'. The default is an empty string, which disables this property.

Remarks

This property allows you to define which pseudocolumns the Sync App exposes as table columns.

To specify individual pseudocolumns, use the following format: "Table1=Column1;Table1=Column2;Table2=Column3"

To include all pseudocolumns for all tables use: "*=*"

Timeout

Specifies the maximum time, in seconds, that the provider waits for a server response before throwing a timeout error. The default is 60 seconds. Set to 0 to disable the timeout.

Remarks

This property controls the maximum time, in seconds, that the Sync App waits for an operation to complete before canceling it. If the timeout period expires before the operation finishes, the Sync App cancels the operation and throws an exception.

The timeout applies to each individual communication with the server rather than the entire query or operation. For example, a query could continue running beyond 60 seconds if each paging call completes within the timeout limit.

Setting this property to 0 disables the timeout, allowing operations to run indefinitely until they succeed or fail due to other conditions such as server-side timeouts, network interruptions, or resource limits on the server. Use this property cautiously to avoid long-running operations that could degrade performance or result in unresponsive behavior.

UserDefinedViews

Specifies a filepath to a JSON configuration file defining custom views. The provider automatically detects and uses the views specified in this file.

Remarks

This property allows you to define and manage custom views through a JSON-formatted configuration file called UserDefinedViews.json. These views are automatically recognized by the Sync App and enable you to execute custom SQL queries as if they were standard database views. The JSON file defines each view as a root element with a child element called "query", which contains the SQL query for the view. For example:

{
	"MyView": {
		"query": "SELECT * FROM User WHERE MyColumn = 'value'"
	},
	"MyView2": {
		"query": "SELECT * FROM MyTable WHERE Id IN (1,2,3)"
	}
}

You can define multiple views in a single file and specify the filepath using this property. For example: UserDefinedViews=C:\Path\To\UserDefinedViews.json. When you use this property, only the specified views are seen by the Sync App.

Refer to User Defined Views for more information.

LDAP Connector for CData Sync

LDAP Connector for CData Sync

Overview

LDAP Version Support

Establishing a Connection

Adding a Connection to LDAP

Connecting to LDAP

Required Properties

Optional Properties

Authenticating to LDAP

SSL Configuration

Customizing Tables

Working with LDAP Tables

Connecting to Custom Tables

Defining a New Table

Defining Table Columns and Inputs

Customizing Column Behavior

Example: Splitting the ObjectClass Attribute

Specifying Column Encoding

Modifying Filter Behavior

Configuring Table Settings

Defining Supported Operations

Advanced Features

User Defined Views

SSL Configuration

Firewall and Proxy

Query Processing

Logging

SSL Configuration

Customizing the SSL Configuration

Firewall and Proxy

Connecting Through a Firewall or Proxy

Data Model

Tables

Stored Procedures

Tables

LDAP Connector for CData Sync Tables

Group

Table Specific Information

Select

Insert

Update

Delete

Columns

Pseudo-Columns

OrganizationalPerson

Table Specific Information

Select

Insert

Update

Delete

Columns

Pseudo-Columns

Person

Table Specific Information

Select

Insert

Update

Delete

Columns

Pseudo-Columns

Top

Table Specific Information

Select

Insert

Update

Delete

Columns

Pseudo-Columns

User

Table Specific Information

Select

Insert

Update

Delete

Columns

Pseudo-Columns

Connection String Options

Authentication

SSL