EAA currently uses the group DN (distinguishedName) as a search filter criteria to synchronize users and groups from LDAP, AD, and LDAPs directories.

Base DN

The Base DN is the starting point or root directory path where an LDAP server searches for directory entries. It commonly consists of these components:

DC (Domain Component). Breaks down your company's network domain name.
OU (Organizational Unit). Represents folders, departments, or divisions inside the domain.
CN (Common Name). Refers to individual objects or default containers (like CN=Users)

Here are some examples for Base DN:

DC=company,DC=com - searches the entire directory tree in the whole domain company.com

OU=Employees,DC=company,DC=com - searches a specific department called Employees

CN=Users,DC=company,DC=com - searches for default Active Directory users.

Group DN:

A group DN (Distinguished Name) is a unique text string that identifies a specific group object inside an LDAP, LDAPs, AD service.

For example, if the Group DN is:

cn=Administrators,ou=Security Groups,dc=corp,dc=company,dc=com

Here

cn=Administrators is the name of the group
ou=Security Groups is the container or folder within the groups
dc=corp,dc=company,dc=com is the root domain component breaking down corp.company.com

The Base DN is used to obtain the users and the Group DN is used to obtain the groups that EAA syncs from the AD, LDAP, LDAPs service.

In most cases your Base DN will be the same as Group DN, although you can customize the values.

Configure Group DN and Base DN

Follow this procedure to configure the Base DN (base distinguished name for user attributes) and Group DN (base distinguished name for group attributes).

Log in to Enterprise Center.
In the Enterprise Center navigation menu, select Application Access > Identity & Users > Directories.
On the directory list page, select the directory you want to add group DN or Base DN.
Select Advanced .
To update Base DN, go to the User Attributes section. Enter the Base DN, the base distinguished name (DN) for user attributes.
To update the Group DN, go to the Group Attributes section. Enter the Group DN, the base distinguished name (DN) for group attributes.
Click Save and Deploy, to save and deploy the changes.

Restrictions

EAA does not support Group DN changes. Review these scenarios and make sure you apply the workaround for your situation.

For example, if your base Group DN is: dc=company,dc=com
And initial group sync is : CN=Administrators,OU=PS,OU=Groups,DC=company,DC=com

Scenario 1:

If you move the group from OU to another OU in the LDAP or AD database; or CN which caused the group to change their DN in the LDAP or AD database

For example from CN=Administrators,OU=PS,OU=Groups,DC=company,DC=com to CN=Administrators,OU=Test,OU=Groups,DC=company,DC=com, EAA will not be able to sync the group.

Workaround:

You must delete the group from EAA and add the group back to EAA again. Alternatively, you can reach out to Akamai support and they can re-map the group to the new DN.

Scenario 2:

For example, if you change the base Group DN from dc=company,dc=com to dc=company2,dc=com

The Administrators group DN was initially CN=Administrators,OU=PS,OU=Groups,DC=company,DC=com

You expect that EAA automatically maps the groups to the new DN which is CN=Administrators,OU=PS,OU=Groups,DC=company2,DC=com

But, EAA will keep syncing the old DN CN=Administrators,OU=PS,OU=Groups,DC=company,DC=com which is no longer valid in AD or LDAP. It will not be aware of the new DN which is CN=Administrators,OU=PS,OU=Groups,DC=company2,DC=com.

Workaround:

You must delete the group from EAA and add the group back to EAA again. Alternatively, you can reach out to Akamai support and they can re-map the group to the new DN.