Download Modifying the Filter String in CUCM

Modifying the Filter String in CUCM
A synchronization agreement configured in CUCM imports data into CUCM by
sending an LDAP search to the LDAP directory store. The search contains a filter
string specified in that query, which causes the LDAP store to filter the query.
Each CUCM cluster may define a single filter that is applied globally to all
synchronization agreements and any authentication configuration defined in that
cluster. That filter string is kept in the CUCM database and may be manipulated
by using the AXL SQL Toolkit. The manipulation of that string will also change
the corresponding string sent in the LDAP search. Although the console CLI has
the ability to run SQL commands, that CLI cannot accept all characters that might
be used in an LDAP filter string, and it is therefore not supported for changing the
filter string.
The AXL SQL Toolkit is included with CUCM and can be accessed via the
Administration Web page under the Plugin menu or directly via the following
URL:
https://<Publisher IP Address>:8443/plugins/axlsqltoolkit.zip
Follow the instructions given with the Toolkit for installation. The Toolkit runs on a
workstation and requires a copy of the Java Runtime Environment.
As described by the Toolkit documentation, an input file to the AxlSqlToolkit
runtime is used to specify the AXL/SOAP message and also the LDAP Query
String. The following example, copied from the files included in the Toolkit,
illustrates the AXL/SOAP message:
<?xml version="1.0" encoding="UTF-8"?>
<!--DTD generated by XMLSPY v5 rel. 4 U (http://www.xmlspy.com)-->
<!DOCTYPE data [
<!ELEMENT data (sql+)>
<!ELEMENT sql EMPTY>
<!ATTLIST sql
query CDATA #IMPLIED
update CDATA #IMPLIED
>
]>
<data>
<sql update="update ldapfilter set filter ='<FilterString>' where
tkldapserver=2"/>
<sql query="select * from ldapfilter where tkldapserver=2"/>
</data>
In a copy of the sample file, replace the text <FilterString> with the desired filter
string. This AXL/SOAP script sends two SQL commands to be executed by the
CUCM database, an update and a query. Those commands are between the two
<data> delimiters.
The update command is:
<sql update="update ldapfilter set filter ='<FilterString>' where tkldapserver=2"/>
This command instructs the database to update the ldapfilter table, setting the
field named filter to the value specified by <FilterString>. The field named
tkldapserver indicates the type of LDAP server. A value of 1 specifies Active
Directory and 2 specifies SunOne or NetScape.
The SQL Query line is used to query the ldapfilter table after the update
command for verification that the update was successful. It queries the database
for the value of the filter field.
NOTE: Sone characters must be escaped when they are entered in the AXL
script. As shown in the example below
Example :
The example custom filter which is to be inserted into the table is,
(&(objectclass=user)(!(objectclass=Computer))(!(UserAccountControl:1.2.840.11
3556.1.4.803:=2))(EmployeeStatus=Active))
In the script, notice that the & character must be escaped so that it is not
interpreted as AXL syntax.
<?xml version="1.0" encoding="UTF-8"?>
<!--DTD generated by XMLSPY v5 rel. 4 U (http://www.xmlspy.com)-->
<!DOCTYPE data [
<!ELEMENT data (sql+)>
<!ELEMENT sql EMPTY>
<!ATTLIST sql
query CDATA #IMPLIED
update CDATA #IMPLIED
>
]>
<data>
<sql update="update ldapfilter set
filter='(&amp;(objectclass=user)(!(objectclass=Computer))
(!(UserAccountControl:1.2.840.113556.1.4.803:=2))(EmployeeStatus=Active))'
where tkldapserver=1"/>
Creating a Custom Filter
Perform the following steps to create a custom filter:
Step 1: Obtain and install the AXL/SQL Toolkit on a standalone workstation.
Found on the Plugins page.
Step 2: Read the included README file and docmentation in the toolkit to
understand the runtime command line syntax.
Step 3: Edit the sample XML file, replacing <FilterString> with the desired filter
string and specify a value of 1 for the tkldaserver value.
Step 4: Add SQL query statement
Step 5: SAve the XML file to a new filename.
Step 6: Run the AxlSqlToolKit Java runtime, specify the file just created as the
inout file.
After successful update of the filter string in the database, you must reload any
services that utilize authentication. This reload always includes DirSynch and
TomCat services as well as any other enabled processes that utilize user
information such as CTIManager.
Once all steps are completed, future synchronization of data and authentication
will use the new filter. Any time the filter needs to be changed, use this same
procedure to overwrite the existing value of the filter string.