You can use LDAP search rules to synchronize data from your LDAP directory server to your organization's Google Account with Google Cloud Directory Sync (GCDS). When you add a search rule, data that matches the search rule is synchronized during your next sync. Data that doesn't match the search rule is removed.
Important: Google does not debug or provide support for LDAP queries.
Basic LDAP query syntax
You can create any custom LDAP search query as long as it complies with RFC 2254.
| Operator | Character | Use |
|---|---|---|
| Equals | = | Creates a filter that requires a field to have a given value. |
| Any | * | Represents a field that can equal anything except NULL. |
| Parentheses | ( ) | Separates filters to allow other logical operators to function. |
| And | & | Joins filters together. All conditions in the series must be true. |
| Or | | | Joins filters together. At least one condition in the series must be true. |
| Not | ! | Excludes all objects that match the filter. |
Add an LDAP search rule
You can use these steps for any type of search rule.
- In Configuration Manager, go to User Accounts
Search Rules.
- Click Add Search Rule.
- From the menu, choose an option to select the scope of the search rule:
- Sub-tree—The search rule applies to the base DN object and all of its child objects.
- One-level—The search rule applies to the immediate children of the base DN object but excludes the base DN itself.
- Object—The search rule applies to only the base DN object.
- For Rule, enter the search rule using LDAP search query syntax.
See examples below.
- For Base DN, choose an option:
- Enter the base DN.
- Leave the field blank to use the base DN specified on the LDAP Connection page.
- Click Test LDAP Query to check the results of your query.
You can review the number of objects found and the first 5 results. Results don't include users without an email address. - Click OK.
- (Optional) To add another search rule, repeat the steps.
Exclude data from a search rule
You can use exclusion rules to exclude data on the LDAP directory server that you don’t want synchronized to your organization's Google Account. For example, you can use an LDAP query to specify that all email addresses should be synchronized. Then, use an exclusion rule to ignore any email addresses that begin with a certain string. For details, go to Use exclusion rules with GCDS.
LDAP query & search rule examples
The following examples are general and might not apply to your environment. Any line breaks are for page formatting only.
Expand section | Collapse all & go to top
Basic LDAP queries- All objects (can cause load problems)
objectClass=*
- All user objects that are designated "person"
(&(objectClass=user)(objectCategory=person))
- Only mailing lists
(objectCategory=group)
- Only public folders
(objectCategory=publicfolder)
- All user objects except those with primary email addresses that begin with "test"
(&(&(objectClass=user)(objectCategory=person))(!(mail=test*)))
- All user objects except those with primary email addresses that end with "test"
(&(&(objectClass=user)(objectCategory=person))(!(mail=*test)))
- All user objects except those with primary email addresses that contain the word "test"
&(&(objectClass=user)(objectCategory=person))(!(mail=*test*)))
- All user and alias objects that are designated "person" and part of a group or distribution list
(|(&(objectClass=user)(objectCategory=person))(objectCategory=group))
- All user objects that are designated as a "person", all group objects, and all contacts except those with any value defined as "extensionAttribute9"
(&(|(|(&(objectClass=user)(objectCategory=person))(objectCategory=group))(objectClass=contact))(!(extensionAttribute9=*)))
- All users who are members of the group identified by the DN "CN=Group,CN=Users,DC=Domain,DC=com"
(&(objectClass=user)(objectCategory=person)(memberof=CN=Group,CN=Users,DC=Domain,DC=com))
- Returns all users
- For Active Directory: (&(objectCategory=person)(objectClass=user))
- For OpenLDAP: (objectClass=inetOrgPerson)
- For HCL Domino: (objectClass=dominoPerson)
- All objects with the mail address designated as a "person" or "group" (in a Domino LDAP directory)
(&(|(objectClass=dominoPerson)(objectClass=dominoGroup)(objectClass=dominoServerMailInDatabase))(mail=*))
- All active (not disabled) users that have email addresses in Active Directory
(&(objectCategory=person)(objectClass=user)(mail=*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
- All users who are members of either Group_1 or Group_2 as defined by the group DN
(&(objectClass=user)(objectCategory=person)(|(memberof=CN=Group_1,cn=Users,DC=Domain,DC=com)(memberof=CN=Group_2,cn=Users,DC=Domain,DC=com)))
- All users who have the extensionAttribute1 value of "Engineering" or "Sales"
(&(objectCategory=user)(|(extensionAttribute1=Engineering)(extensionAttribute1=Sales)))
- Recursively retrieve the group members nested under the specified group in Active Directory
(&(objectCategory=person)(objectClass=user)(memberOf:1.2.840.11356.1.4.1941:=CN=MyGroup,CN=Users,DC=domain,DC=com))
- Group membership query with ObjectGUID in Active Directory. The hexadecimal value of the ObjectGUID attribute of a group is 4e542fe785b1bb274e542fe785b1bb27
(&(objectCategory=person)(objectClass=user)(memberOf=GUID=4e542fe785b1bb274e542fe785b1bb27))
Optimize your search rules
You can optimize search rules to improve sync performance.
| Example 1: Return users with email address | Use case |
|---|---|
| User search rule: (&(objectClass=user)(objectCategory=person)(mail=*)) | Instead of using a basic rule to return all users, optimize your rule by using the mail= query.
The sync performs more efficiently as the LDAP server and GCDS don't have to process entries that would otherwise be discarded. |
| Example 2: Return users with email address matching string | Use case |
|---|---|
| User search rule: (&(objectClass=user)(objectCategory=person)(mail=*)(!(mail=sales*))) | Instead of using a basic rule and an exclusion rule to return all users with an email address that doesn't have sales, use an optimized rule with a matching string.
The LDAP server and GCDS don't have to process entries that would otherwise be discarded. And, you don't have to set up an exclusion rule or consider the priority level. |
Related topic
Google, Google Workspace, and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.
