Configuring LDAP filter query for multiple OUs in IDE Services – Support | JetBrains

Question

How can I configure LDAP settings in IDE Services to select users from two specific Organizational Units (OUs) while ensuring reliable login functionality?

Answer

Currently, IDE Services leverages a single user-object-filter for both login and LDAP synchronization and does not officially support multiple Organizational Units (OUs). Below are the steps and best practices to configure LDAP to match your scenario, along with known limitations and workarounds.

Steps to Configure LDAP for Multiple OUs

Set a broad Base DN: Use a broad base-dn value such as DC=politie,DC=local to ensure all required OUs are included in the scope of the LDAP search.
```
base-dn: 'DC=politie,DC=local'
```
Use a narrowed user-object-filter: Ensure your user-object-filter excludes unnecessary accounts and stays well below the AD limit of 1000 users. For example, base filtering on group membership:
```
user-object-filter: '(&(objectClass=Person)(memberOf=CN=PDC_USR_G_TPE-jira-users,OU=TPE,OU=Groepen,OU=PDC,DC=politie,DC=local))'
```
Note: This helps mitigate large searches that may result in login instability.
Support multiple OUs with user-additional-dn: While user-additional-dn officially supports only a single value, you can use the following multi-OU workaround:
```
user-additional-dn: ['OU=PDC','OU=NP']
```
This workaround allows user searches to be limited to the two specified OUs. However, it is not officially documented or guaranteed.

Limitations

Login and Sync Share the Same Filter: The current configuration does not allow separate filters for login and synchronization. This means all LDAP queries use the same user-object-filter, leading to inefficiencies.
LDAP Paging Not Supported: AD servers like Microsoft Active Directory have a default search size limit of 1000 entries. Without LDAP paging, large results exceeding this limit can disrupt login processes.
Instability Across Multiple OUs: Users distributed across multiple OUs can cause inconsistent behavior, as IDE Services does not fully support multi-OU setups.

Workarounds

Group-Specific Filters: Narrow down the scope of the LDAP search by focusing on groups or restricting the total number of users returned by the filter.
Multi-OU in user-additional-dn: Use the undocumented workaround for multiple OUs (user-additional-dn: ['OU=PDC','OU=NP']). Ensure all users in the target groups or OUs are covered by the search scope.

Next Steps and Future Developments

LDAP Paging: IDE Services does not currently implement paging for larger LDAP result sets.
Separate Filters for Login vs Sync: A feature request to enable distinct filters for login and sync has been raised but remains under review.
Multi-OU Support: Multi-OU compatibility may be officially supported in a future release pending development team review and prioritization.

For further assistance, ensure your configurations adhere to current best practices documented at IDE Services LDAP Configuration Guide.

PS: Feature requests to address these gaps have been logged and updates will follow as the engineering team progresses.