---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Define LDAP organizational units

# Define LDAP organizational units {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 Minuten Lesedauer

An organizational unit (OU) definition specifies the LDAP source directories
available to the integration.

## Vorbereitungen

Role required: admin.

## Warum und wann dieser Vorgang ausgeführt wird

OU definitions can contain locations, people, or user groups. Every LDAP server
definition contains two sample OU definitions: one for importing groups into the
system and the other for users.

## Prozedur

1. Navigate to AllSystem LDAPLDAP Servers.
2. Select the LDAP server to configure.
3. In the LDAP OU Definitions related list, select either the Groups or Users sample OU definition.
4. Complete the LDAP OU Definition form (see table).
5. Click Update.  
   The system automatically tests the connection to the LDAP server.
6. Under Related Links, click Browse to view the LDAP directory records that the OU definition returns.  
   {#t_DefineLDAPOrganizationalUnits__table_frt_c1c_wp__entry__2}{#t_DefineLDAPOrganizationalUnits__entry_LdapServerName}{#t_DefineLDAPOrganizationalUnits__entry_LdapQueryField}{#t_DefineLDAPOrganizationalUnits__entry_LdapTable}{#t_DefineLDAPOrganizationalUnits__entry_LdapFilter}

   | Field | Description |
   |-|-|
   | Name | Specify the name the integration uses when referencing this OU. The name you enter here becomes an LDAP target in the data source record. |
   | RDN | Specify the relative distinguished name of the subdirectory you want to search. This RDN is combined with the start-searching directory from the LDAP server definition to identify the subdirectory containing information for this organizational unit. For example, the sample OU definition uses the RDN value of <kbd class="ph userinput">CN=Users</kbd> to search the LDAP directory <kbd class="ph userinput">CN=Users,DC=service-now,DC=com</kbd> and any directory below this point. This field must match a subdirectory in your LDAP system. |
   | Query field | Specify the name of the attribute within the LDAP server to query for records. The query field must be unique in both single and multiple domain instances. For best results, use email addresses or other credentials that uniquely identify the user in a multiple domain instance. Active Directory uses the sAMAccountName attribute. Other LDAP servers tend to use the cn attribute. Hinweis: The Query field must map to the User ID field in the User \[sys_user\] table. For example, if an Active Directory user logs in as <kbd class="ph userinput">joe.example</kbd>, there must be a user record with a User ID value of joe.example and an LDAP record with an sAMAccountName value of joe.example. |
   | Active | Select this check box to activate the OU definition and to allow administrators to test importing data. However, the integration can only bring data into the system from active OU definitions. |
   | Table | Specify the table that receives the mapped data from your LDAP server. For users, select User (sys_user), and for groups, select Group (sys_group). |
   | Filter | Enter an LDAP filter string to select specific records to import from the OU. The more specific the LDAP filter query, the more efficient the query is. For example, the Users LDAP OU definition uses the following filter to select records that are classified as a person, have an sn attribute value, are not computers, and are not flagged as inactive: `(&(objectClass=person)(sn=*)(!(objectClass=computer)) (!(userAccountControl:1.2.840.113556.1.4.803:=2)))` You can find a description of LDAP filter syntax by searching the internet for <kbd class="ph userinput">LDAP Filters RFC</kbd>. |
   [Tabelle : 1. OU Definition form]

   {#t_DefineLDAPOrganizationalUnits__table_frt_c1c_wp}

## Example organizational unit definitions

Suppose you have an LDAP server with the following directory structure:

dc=my-domain,dc=com

* ou=Groups
  * cn=Development
  * cn=HR
  * cn=Sales
  {#t_DefineLDAPOrganizationalUnits__ul_vsn_5zb_wp}
* ou=Users
  * ou=Development
  * ou=HR
  * ou=Sales
  {#t_DefineLDAPOrganizationalUnits__ul_etn_5zb_wp}

{#t_DefineLDAPOrganizationalUnits__ul_psn_5zb_wp}

Further suppose that you want to exclude the HR group and HR users from the
application. Do the following:

1. Create an LDAP server record with a starting search directory of dc=my-domain,dc=com.
2. Create an OU definition record for ou=Groups with a filter to exclude cn=HR.
3. Create an OU definition record for ou=Users with a filter to exclude ou=HR.

{#t_DefineLDAPOrganizationalUnits__ol_sjh_xjv_1r}

If you do not specify additional attributes or filters with an OU definition, the
LDAP query returns the entire sub-tree from the starting directory and RDN.

In these examples, an OU definition with the RDN value of ou=Groups and no filter
would have returned all groups. Likewise, an OU definition with the RDN value of
ou=Users and no filter would have returned all users and child organizational units.