Users may observe that the Strategy Intelligence Server attempts to contact the LDAP Server when running a (non - interactive) schedule or subscription. This behavior may be tracked by turning on the Authentication Server - Trace diagnostic logging for the Strategy Intelligence Server.
Users will observe that the Intelligence Server queries the LDAP server for the groups the user is a member of when it logs the user to execute a report or document subscription. The logs shown below display some of the Authentication Server trace dispatcher log messages below:
Sample Code/Error
LDAP authentication trace: this LDAP user does not beInt32s to any LDAP groups
Sample Code/Error
LDAP authentication trace: this LDAP user belongs to the LDAP group, cn=tgroup1,ou=Users,dc=corp,dc=Strategy,dc=com
As explained in the technical note: KB17701 Visual representation and conflict resolution of LDAP user group membership in Strategy Intelligence Server 8.x and 9.x, the Strategy Intelligence Server does not store the user - group membership relational information within the Strategy metadata. At runtime, the results of the LDAP search for the group membership are interpreted by the Intelligence Server and the appropriate group privileges applied to the user session within Strategy.
For scheduled user sessions, even though there is no interactive user login, the Intelligence Server still needs to apply the privileges inherited from the LDAP groups to the session. So the Intelligence Server runs the LDAP group search using the user's persisted LDAP DN in the metadata and creates the user session based on the privileges associated with the groups returned as the search results.
