Results Not showing - 2016 about ldapcp

[Yvand]

Can you check SharePoint logs and filter on Product/Area LDAPCP ?

[barnabus86]

Thanks for the quick response.

I've had a look in the logs on both of our WFE Servers and can only see the following with a Area of LDAPCP

[LDAPCP] LdapcpConfig PersistedObject changed, refreshing configuration af4b169e-bcb8-905a-1330-573c79e468af

Looking further in to the logs, i can see the following

[LDAPCP] Got 3 result(s) in 0ms from

[LDAPCP] Added permission: claim value: "", claim type: "http://schemas.microsoft.com/2012/01/devicecontext/claims/isregistereduser" d54b169e-bc92-905a-3b7c-676cf146b6da

because Name is a protected Claim, i have mapped display name from Adfs (Adfs v4/2016) as "isregistereduser" (this is only a test environment).

Some of our users have a normal user account and a domain admin account. If i search for any of these users by name, it shows 2 results, but only displays the Domain Admin account (we wouldn't want to give these accounts permissions).

To add, we are running LDAPCP v2017.06

[Yvand]

It's a bit weird
Can you show the claims mapping configuration in central admin > security > LDAPCP claims mapping page?

[barnabus86]

We were previously mapping the UPN against the LDAP attribute UPN, but decided to use sAMAccountName instead. I haven't updated the ADFS claim type to "windows account name" as i already had UPN mapped as a claim type in my trusted token issuer. I'm happy to change this if you think it makes a difference.

[Yvand]

The last row may be the cause of this: it duplicates the displayName attribute on the previous row (the "linked to identity claim" one).
But do you really need the claim type isregistereduser? I don't think it makes sense to bind a claim type to the attribute displayName: it's not unique and 2 users may have the same.

Can you try to remove isregistereduser row and see if results are returned correctly?
Otherwise, if you really need isregistereduser claim type, you may remove the displayName row "linked to identity claim"

[barnabus86]

Hi Yvand,

Removing the isregistereduser has resolved the issue.

Thanks for the help.

LDAPCP has really saved us a lot of time in our move to ADFS Authentication.

[Yvand]

Awesome, thank you for your feedback :)