Empty groups after LDAP group synchronization due to incorrect group scope

Empty groups after LDAP group synchronization due to incorrect group scope

When using global catalog port in your LDAP configuration on your TIBCO Spotfire Server configuration with group sync enabled, after a completed synchronization there are some groups which are coming in empty without any users under those groups. There may be other possible causes such as the LDAP bind account having insufficient privileges to read the member/memberOf properties on the user and group objects, but one potential issue is the scope defined on the group object in the directory.

To resolve, change the group scope from "Global" to "Universal". If the global catalog is used in the LDAP configuration then the group scope has to be "Universal".
Group Scope:

• https://technet.microsoft.com/en-us/library/cc755692(v=ws.10).aspx

KB: Difference between using the default port 389 and default Global Catalog port 3289 in a Spotfire LDAP configuration.

• https://support.tibco.com/s/article/Tibco-KnowledgeArticle-Article-45123