By default, the HES ActiveDirectory Sync Client searches for an object class "User" and its three attributes:
These defaults are set in an XML configuration file called IMHS_AD_ACL.config, whose contents are shown in the figure below:
However, the client provides the flexibility for you to modify these defaults if you wish. For example, if for purposes of confidentiality you would like for the client to search only for proxy addresses but not email addresses or display names, you could modify these settings by revising the config file as shown in the figure below:
You can leave the default value as is but add more alternate path names. For example, as shown in the figure below:
You can also add self-defined object classes or attribute names. If you modify this config file, save it and restart the client in order for your changes to take effect.
Note: The tag is the root tag in this XML file. Although you can add multiple blocks, there can be only one opening tag and one closing tag in the IMHS_AD_ACL.config file.
Inheritance of Object Classes
In Active Directory schema, object classes can be inherited. If an object class is configured in IMHS_AD_ACL.config, then the objects of its subclasses under the same LDAP path will be retrieved as well. Take this into consideration when modifying the ACL configuration file.
For example, in config file sample A, the first of the two sample configuration files shown in the figure below, class inetOrgPerson is a subclass of user. If for the same LDAP path we configure the object class user, as in config file sample B, the query will also retrieve inetOrgPerson objects. Both of these configuration files would retrieve the same objects.
It is not necessary to configure inetOrgPerson. Whereas, if we remove inetOrgPerson from the ACL file but keep the user, objects of inetOrgPerson will still be retrieved. In other words, if an object class is removed from ACL, its entries in the server will be removed if they are not in other object classes specified in ACL.
Note: HES preserves this config file for future use, even if you re-install the client.