- 14 minutes to read

User Management with the Nodinite LDAP Web API

Comprehensive user management operations for LDAP directories using the Nodinite LDAP Web API. This page covers all 16 user-specific operations with detailed XML examples.

✅ CRUD Operations: Select, Create, Update, Delete users
✅ Account Management: Enable, Disable, Rename, Move users
✅ Group Operations: GetGroupMembership, AddToGroups, RemoveFromGroups
✅ Advanced Queries: SelectActive, SelectDisabled, SelectByDate
✅ Batch Support: Process multiple users in single operations

Understanding User Operations

User operations are available in the Operations section of the User record within the request message. Every operation uses the With record to define search criteria and scope; the LDAP Web API first finds the matching users, then runs each operation on them.

flowchart LR Client["fa:fa-code Client"] -->|"Execute request (XML or JSON)"| API["fa:fa-cloud LDAP Web API"] API -->|"With: CN, OU, DC, searchScope, searchFilter"| Dir["fa:fa-address-book LDAP directory"] Dir -->|"Matching users"| API API -->|"Operations on each matched user"| Dir API -->|"SearchResult and OperationResult"| Client

Diagram: the LDAP Web API resolves the With query against the directory, then runs the user operations on every user found and returns both results.

Both XML and JSON formats are supported. See the Request Schema for message structure details.

Operations Summary

Operation Description Multiple Records
Select Retrieve user records from LDAP ✅ Yes
Create Create new user with properties and password ❌ No
Update Update existing user properties ✅ Yes
Delete Delete user records ✅ Yes
Rename Rename user (CN part) ❌ No
MoveTo Move users to different OU ✅ Yes
GetGroupMembership Retrieve group memberships ✅ Yes
AddToGroups Add users to one or more groups ✅ Yes
RemoveFromGroups Remove users from groups ✅ Yes
SelectActive Get all active (enabled) users ✅ Yes
SelectDisabled Get all disabled users ✅ Yes
Enable Enable disabled user accounts ✅ Yes
Disable Disable active user accounts ✅ Yes
SelectByDate Query users by date property ✅ Yes
Recover ⚠️ Not implemented in v1.0 ❌ No
SelectDeleted ⚠️ Not implemented in v1.0 ❌ No

Select

The Select operation retrieves user records from the LDAP catalog using the search criteria provided in the With record.

Example: Select Users by CN 

<ns0:LDAP xmlns:ns0="http://integrationsoftware.se/BizTalk/Adapters/LDAP/Request/1.0">
  <Batches guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D" returnResponseMessageOnExceptions="true">          
    <Batch guid="3B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8E">
      <User>
        <With CN="CN=Michael Olsson" OU="OU=Users,OU=Karlstad" DC="DC=ibiz,DC=local"/>
        <Operations>          
          <Select/>
        </Operations>
      </User>
    </Batch>
  </Batches>
</ns0:LDAP>

Tip

Use the returnProperties attribute (see Request Schema) to limit the number of properties returned from the query.

Create

The Create operation creates a new user within an OU found using the With record search criteria.

Attributes

Attribute Required Description
name ✅ Yes The common name (CN part) of the user to create
flags / removeflags ❌ No User account control flags, as described in ADS_USER_FLAG_ENUM. Combine multiple flags with commas (no whitespace): ADS_UF_LOCKOUT,ADS_UF_PASSWD_NOTREQD

Warning

Not all flag combinations are valid!

Password Element

The Password element is optional in the schema but may be required depending on your LDAP catalog policies.

Note

  • Password operations may need special connection settings and user rights (see Configuration)
  • Passwords must meet complexity, length, and policy requirements of the target LDAP catalog
  • The operation fails if the password doesn't meet these requirements

Example: Create a User with Password 

<ns0:LDAP xmlns:ns0="http://integrationsoftware.se/BizTalk/Adapters/LDAP/Request/1.0">
  <Batches guid="B7A211D7-20F3-44BC-B078-7F1B6E1C047F" returnResponseMessageOnExceptions="true">
    <Batch guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D" continueOnError="false">
      <User>
        <With OU="OU=Old Hackers" DC="DC=ibiz,DC=local" searchScope="Base" 
expectedMatchCount="1" returnProperties="name,description" />
        <Operations>
         <Create name="Jane Doe13">            
            <Password>Password_0!%¤"#¤</Password>
            <Properties>
              <Property name="description" value="Description set from LDAP Adapter from Integration Software." contentType="String"/>
            </Properties>
          </Create>
        </Operations>
      </User>
    </Batch>
  </Batches>
</ns0:LDAP>

Tip

Create operation supports special handling of thumbnailPhoto and jpegPhoto attributes (see Properties section).

Update

The Update operation modifies existing user records. Structurally similar to Create, but supports updating multiple records in one operation.

Key Features

✅ Multiple Records: Update all users matching search criteria
✅ Multi-valued Attributes: Set multiple values for attributes like url
✅ Multiple Operations: Chain operations (later operations can overwrite earlier ones)
✅ Blank Attributes: Remove attribute values by setting empty string

Example: Update Users with Multi-Valued Attributes 

<ns0:LDAP xmlns:ns0="http://integrationsoftware.se/BizTalk/Adapters/LDAP/Request/1.0">
  <Batches guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D" returnResponseMessageOnExceptions="true">
    <Batch guid="3B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8E">
      <User>
        <With OU="OU=Old hackers" DC="DC=ibiz,DC=local" searchScope="Subtree" 
searchFilter="(name=j*)"/>
        <Operations>
          <Update>
            <Properties>
              <Property name="url" value="http://www.example1.com" contentType="String"/>
              <Property name="url" value="http://www.example2.com" contentType="String"/>
              <Property name="description" value="First description" contentType="String"/>
            </Properties>
          </Update>
          <Update>
            <Properties>
              <Property name="description" value="Second description overwrites first" contentType="String"/>
              <Property name="mail" value="" contentType="String"/>
            </Properties>
          </Update>
        </Operations>
      </User>
    </Batch>
  </Batches>
</ns0:LDAP>

Note

Setting an attribute to blank (value="") removes all values for multi-valued attributes.

Delete

The Delete operation removes one or more users from the LDAP catalog based on the With record search criteria.

Warning

EXTREMELY DANGEROUS OPERATION

The Delete operation can permanently remove users from Active Directory and potentially wipe your entire directory if search criteria are too broad.

ALWAYS use expectedMatchCount attribute to specify the exact number of records you intend to delete. This safety check prevents accidental mass deletions. Follow these safety recommendations:

  • Use expectedMatchCount - Set to the exact number of objects you expect (e.g., expectedMatchCount="1")
  • Test with Select first - Run identical With criteria using Select operation to verify what will be deleted
  • Test in non-production - Always test Delete operations in development/test environments first
  • Use specific filters - Never use broad filters like searchScope="Subtree" without specific searchFilter or CN attributes
  • Backup before bulk deletes - Ensure Active Directory backups are current before large deletion operations
  • Restrict permissions - Limit LDAP Web API service account permissions to specific OUs where deletions are allowed

Compare a safe and an unsafe query:

  • ✅ Safe: CN="CN=Jane Doe9" + expectedMatchCount="1" (deletes exactly one specific user)
  • ❌ Unsafe: searchScope="Subtree" + searchFilter="(name=*)" without expectedMatchCount (could delete ALL users)

See Request Schema - expectedMatchCount for detailed attribute documentation and examples.

Example: Delete a User by CN 

<ns0:LDAP xmlns:ns0="http://integrationsoftware.se/BizTalk/Adapters/LDAP/Request/1.0">
  <Batches guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D" returnResponseMessageOnExceptions="true">
    <Batch guid="3B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8E">
      <User>
        <With CN="CN=Jane Doe9" OU="OU=Old Hackers" DC="DC=ibiz,DC=local" searchScope="Subtree" 
expectedMatchCount="1" returnProperties="name,description"/>
        <Operations>
          <Delete/>
        </Operations>
      </User>
    </Batch>
  </Batches>
</ns0:LDAP>

The response SearchResults record shows users found for deletion, and OperationResult displays users that were actually deleted.

Rename

The Rename operation changes the name (CN part) of a user. The target name must not already exist, or the operation fails.

Attributes

Attribute Required Description
name ✅ Yes The new name for the user object. Since only one object can have this unique name, this operation only works with single-record searches

Example: Rename a User 

<ns0:LDAP xmlns:ns0="http://integrationsoftware.se/BizTalk/Adapters/LDAP/Request/1.0">
  <Batches guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D" returnResponseMessageOnExceptions="true">
    <Batch guid="3B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8E">
      <User>
        <With CN="CN=John Doe" OU="OU=Old Hackers" DC="DC=ibiz,DC=local" searchScope="Subtree" 
expectedMatchCount="1" returnProperties="name,description"/>
        <Operations>
          <Rename name="Jane Doe"/>          
        </Operations>
      </User>
    </Batch>
  </Batches>
</ns0:LDAP>

MoveTo

The MoveTo operation moves users found by the With search criteria to the destination OU specified in the operation arguments.

Attributes

Attribute Required Description
DC ✅ Yes Domain Component for the destination
OU ✅ Yes Organizational Unit path for the destination
CN ❌ No Common Name for the destination (rarely used for user moves)

Example: Move Users to Another OU 

<ns0:LDAP xmlns:ns0="http://integrationsoftware.se/BizTalk/Adapters/LDAP/Request/1.0">
  <Batches guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D">          
    <Batch transactionScopeOption="Required" continueOnError="false" 
guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D">
      <User>
        <With OU="OU=3l1t hackers,OU=Old hackers" DC="DC=ibiz,DC=local" searchScope="Subtree" 
searchFilter="(objectClass=user)(name=j*)"/>
          <Operations>
            <MoveTo OU="OU=Old hackers" DC="DC=ibiz,DC=local"/>
        </Operations>
      </User>
    </Batch>
  </Batches>
</ns0:LDAP>

The response OperationResult shows the destination OU and count of users moved.

GetGroupMembership

The GetGroupMembership operation retrieves the distinguishedName of all groups for the users found in the search.

Example: Get Group Memberships 

<ns0:LDAP xmlns:ns0="http://integrationsoftware.se/BizTalk/Adapters/LDAP/Request/1.0">
  <Batches guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D" returnResponseMessageOnExceptions="true">          
    <Batch transactionScopeOption="Required" continueOnError="false" 
guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D">
      <User>
        <With OU="OU=Old hackers" DC="DC=ibiz,DC=local" searchScope="Subtree" 
returnProperties="name,description"/>
          <Operations>
            <GetGroupMembership/>
        </Operations>
      </User>
    </Batch>
  </Batches>
</ns0:LDAP>

Note

  • A user can belong to 0 or more groups
  • The memberOf attribute is always included in SearchResult (if user has group membership), independent of the returnProperties attribute

AddToGroups

The AddToGroups operation adds users found in the search to one or more specified groups.

Tip

If a user is already a member of a group, the add operation is skipped, but the result shows success.

Example: Add Users to Groups 

<ns0:LDAP xmlns:ns0="http://integrationsoftware.se/BizTalk/Adapters/LDAP/Request/1.0">
  <Batches guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D">          
    <Batch continueOnError="false" guid="3B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8E">
      <User>
        <With OU="OU=Old hackers" DC="DC=ibiz,DC=local" searchScope="Subtree" 
searchFilter="(name=j*)"/>
          <Operations>
            <AddToGroups>
              <Group CN="CN=ateam" OU="OU=Old hackers" DC="DC=ibiz,DC=local"/>                
              <Group CN="CN=bteam" OU="OU=Old hackers" DC="DC=ibiz,DC=local"/>
            </AddToGroups>            
        </Operations>
      </User>
    </Batch>
  </Batches>
</ns0:LDAP>

The response SearchResult shows users found, and OperationResult lists the groups they were added to.

RemoveFromGroups

The RemoveFromGroups operation removes users found in the search from one or more specified groups.

Tip

If a user is not a member of a group, the remove operation is skipped, but the result shows success.

Example: Remove Users from Groups 

<ns0:LDAP xmlns:ns0="http://integrationsoftware.se/BizTalk/Adapters/LDAP/Request/1.0">
  <Batches guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D">          
    <Batch continueOnError="false" guid="3B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8E">
      <User>
        <With OU="OU=Old hackers" DC="DC=ibiz,DC=local" searchScope="Subtree" 
searchFilter="(name=j*)"/>
          <Operations>
            <RemoveFromGroups>
              <Group CN="CN=ateam" OU="OU=Old hackers" DC="DC=ibiz,DC=local"/>                
              <Group CN="CN=bteam" OU="OU=Old hackers" DC="DC=ibiz,DC=local"/>
            </RemoveFromGroups>            
        </Operations>
      </User>
    </Batch>
  </Batches>
</ns0:LDAP>

SelectActive

The SelectActive operation retrieves all active (not disabled) users matching the With search criteria.

Example: Get All Active Users 

<ns0:LDAP xmlns:ns0="http://integrationsoftware.se/BizTalk/Adapters/LDAP/Request/1.0">
  <Batches guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D" returnResponseMessageOnExceptions="true">          
    <Batch transactionScopeOption="Required" continueOnError="false" 
guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D">
      <User>
        <With OU="OU=Old hackers" DC="DC=ibiz,DC=local" searchScope="Subtree" 
returnProperties="name,description"/>
          <Operations>
            <SelectActive/>
        </Operations>
      </User>
    </Batch>
  </Batches>
</ns0:LDAP>

SelectDisabled

The SelectDisabled operation retrieves all disabled users matching the With search criteria.

Example: Get All Disabled Users 

<ns0:LDAP xmlns:ns0="http://integrationsoftware.se/BizTalk/Adapters/LDAP/Request/1.0">
  <Batches guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D" returnResponseMessageOnExceptions="true">          
    <Batch transactionScopeOption="Required" continueOnError="false" 
guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D">
      <User>
        <With OU="OU=Old hackers" DC="DC=ibiz,DC=local" searchScope="Subtree" 
returnProperties="name,description"/>
          <Operations>
            <SelectDisabled/>
        </Operations>
      </User>
    </Batch>
  </Batches>
</ns0:LDAP>

Enable

The Enable operation enables disabled user accounts matching the With search criteria.

Example: Enable Disabled Users 

<ns0:LDAP xmlns:ns0="http://integrationsoftware.se/BizTalk/Adapters/LDAP/Request/1.0">
  <Batches guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D" returnResponseMessageOnExceptions="true">          
    <Batch transactionScopeOption="Required" continueOnError="false" 
guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D">
      <User>
        <With OU="OU=Old hackers" DC="DC=ibiz,DC=local" searchScope="Subtree" 
returnProperties="name,description"/>
          <Operations>
            <Enable/>
        </Operations>
      </User>
    </Batch>
  </Batches>
</ns0:LDAP>

Note

The SearchResult record displays all users found in the query, and OperationResult contains users that were enabled.

Disable

The Disable operation disables active user accounts matching the With search criteria.

Example: Disable an Active User 

<ns0:LDAP xmlns:ns0="http://integrationsoftware.se/BizTalk/Adapters/LDAP/Request/1.0">
  <Batches guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D" returnResponseMessageOnExceptions="true">
    <Batch guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D">
      <User>
        <With CN="CN=Jane Doe" OU="OU=Old hackers" DC="DC=ibiz,DC=local" searchScope="Subtree" 
expectedMatchCount="*"/>
          <Operations>
            <Disable/>
        </Operations>
      </User>
    </Batch>
  </Batches>
</ns0:LDAP>

Note

The SearchResult record displays all users found in the query, and OperationResult contains users that were disabled.

Tip

You can combine the Disable operation with Update and other operations in the same batch.

SelectByDate

The SelectByDate operation returns users based on a datetime property search.

Attributes

Attribute Required Description
propertyName ✅ Yes The name of the datetime property to search (e.g., whenCreated, whenChanged)
relationalOperator ✅ Yes Valid values: =, >=, <=, ~=. See Search Filter Syntax
value ✅ Yes The UTC datetime value in ISO 8601 format

Warning

LDAP stores times in UTC. Convert from your local timezone to UTC before sending the request. See DateTime.ToUniversalTime.

Example: Get Users Changed After a Date 

<ns0:LDAP xmlns:ns0="http://integrationsoftware.se/BizTalk/Adapters/LDAP/Request/1.0">
  <Batches guid="2B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8D" returnResponseMessageOnExceptions="true">          
    <Batch guid="3B25B9E6-4AF2-4094-9AE7-E1E4C99B6C8E">
      <User>
        <With OU="OU=Old hackers" DC="DC=ibiz,DC=local" searchScope="Subtree" 
returnProperties="name,description,distinguishedName,whenCreated,whenChanged"/>
          <Operations>
            <SelectByDate propertyName="whenChanged" relationalOperator=">=" 
value="2013-10-18T08:00:00" />
        </Operations>
      </User>
    </Batch>
  </Batches>
</ns0:LDAP>

Recover

Warning

The Recover operation does not work in version 1.0 and will throw a NotImplementedException. Do not call this method!

The Recover operation is intended to restore deleted users within the tombstone time limit.

SelectDeleted

Warning

The SelectDeleted operation does not work in version 1.0 and will throw a NotImplementedException. Do not call this method!

Next Steps