Migrating from OpenDJ to OneAD
> LDAP Migration Guidance
OpenDJ is an LDAP directory, deployed in PwC Identity, which contains a rich set of data for all PwC Staff and onboarded contractors, and external users. As part of the effort to decommission legacy identity systems, all applications that currently connect to the OpenDJ LDAPs must be migrated over to OneAD.
The document provides comprehensive guidance for this migration, detailing prerequisites, environment comparisons, user data attribute mappings, and operational contacts to support application owners through the transition.
This migration is part of PwC's broader identity modernization initiative, supporting the transition from ForgeRock Identity Platform to Microsoft Entra ID while maintaining LDAP connectivity for applications that require directory services.
Migration Prerequisites
Application teams should have a OneAD service account which, if one does not exist, can be requested following these steps.
Before migrating an application from OpenDJ to OneAD, please confirm the following items have been completed for all environments (Development, Staging and Production) if applicable:
- Credentials for the OneAD Service account (steps to request are above)
- Ensure appropriate SSL Certificates are in place to establish a secure connection via LDAPS from application to OneAD directory.
- Ensure connectivity to appropriate OneAD environments.
-
All OneAD is opened to
10.0.0.0/8and172.16.0.0/12 -
In case of network connectivity issues, please raise an incident with Perimeter security and provide the appropriate source & destination details to them to investigate
-
Perimeter Security Service Now Queue:
GBL - TSO - PERIMETER SECURITY
- Please use DNS names for the directories in your code/configuration and do not use IP addresses.
- In case your application requires custom pieces, work with your dedicated regional PoD team on proper next steps.
Side-by-Side Comparisons
Environment Comparison
The table below provides a side-by-side comparison between the current OpenDJ environment and target OneAD environment:
| Component | OpenDJ | OneAD |
|---|---|---|
| Physical Location | Microsoft Azure US Microsoft Azure NL Microsoft Azure SG | N/A: OneAD is a global service |
| Base DN | dc=pwc,dc=com | dc=pwcgbl,dc=com |
| Internal Users | ou=Internal,ou=People,dc=pwcglobal,dc=com | Separated by territory: OU=Users, OU=Tier 2, OU=XX, OU=Territories, DC=pwcglb, DC=com where XX = two letter country code of the territoryNote: if performing a global search for groups, start at OU=Territories,DC=pwcglb,DC=com |
| External Users | ou=Self-Reg,ou=People,dc=pwcglobal,dc=com | N/A There are no external users in OneAD |
| Groups | ou=Groups,dc=pwcglobal,dc=com | OU=Groups,OU=Tier 1, OU=XX, OU=Territories,DC=pwcglb,DC=com where XX = two letter country code of the territoryNote: if performing a global search for groups, start at OU=Territories,DC=pwcglb,DC=com |
| Application Accounts | ou=Applications,dc=pwcglobal,dc=com | OU=Service Accounts,OU=Tier 1, OU=XX, OU=Territories, DC=pwcglb,DC=com where XX = two letter country code of the territoryNote: if performing a global search for groups, start at OU=Territories,DC=pwcglb,DC=com |
| Port | 636 | 636 |
| Development Global and Regional VIP | iam-userstore-dev.pwcinternal.com | directory.pwcglb.com |
| Staging Regional VIPs | iam-userstore-stg-us.pwcinternal.com iam-userstore-stg-eu.pwcinternal.com iam-userstore-stg-asia.pwcinternal.com | directory.pwcglb.com |
| Stage Global Traffic Manager VIP | iam-userstore-stg-iam.pwcinternal.com | |
| Production Regional VIPs | iam-userstore-prod-iam-us.pwcinternal.com iam-userstore-prod-iam-eu.pwcinternal.com iam-userstore-prod-iam-asia.pwcinternal.com | directory.pwcglb.com |
| Production Global Traffic Manager VIP | Iam-userstore-prod-iam.pwcinternal.com | directory.pwcglb.com |
User Data Attribute Comparison
for PwC Staff and contractors
PwC user data in OneAD is sourced from PMDM, just as it is in PwC Identity OpenDJ, and follows same Controlled Vocabularies. However, because they are different directories by different vendors, some data is stored in different attribute names. This table lists the attribute name differences between OneAD and OpenDJ.
OpenDJ contains considerable duplicated and legacy data, none of which is in OneAD. If your application needs an attribute that has not been configured to flow to OneAD, it can easily be added upon request.
| OpenDJ Attribute | OneAD Attribute | Sample Value | Additional Info |
|---|---|---|---|
| c | pwcISOCountryCode | US | |
| cn | displayName | Sally Staff | |
| company | company | PwC ITSCo USA | |
| displayName | displayName | Sally Staff | |
| employeeNumber | employeeID | 333333333 | |
| facsimileTelephoneNumber | facsimileTelephoneNumber | (813) 555-5555 | While attribute exists, it is not populated in OneAD with data |
| givenName | givenName | Sally | |
| msDS-cloudExtensionAttribute7 | Sally.staff@us.pwc.com | This is the legacy Notes email value for users | |
| mobile | mobile | +1 813-555-1212 | |
| o | o | PricewaterhouseCoopers IT Services (US) LLC | |
| postalCode | postalCode | 78703 | |
| preferredLanguage | preferredLanguage | en | In OneAD this is in the format of language-country, e.g., en-US |
| pwcAFWCloudMail | N/A | Sally.staff@afw.pwc.com | Legacy value for Android for Work, which is no longer used |
| pwcaltstreet2 | N/A | Suite 1600 | Does not exist in OneAD |
| PwCassignedOffice | N/A | Austin - 835 W 6th Street | Does not exist in OneAD |
| PwCassignedofficecode | N/A | 12752718 | Does not exist in OneAD |
| PwCcity | N/A | Austin | Does not exist in OneAD |
| pwcCloudMail | N/A | Sally.staff@pwc.com | Does not exist in OneAD. See pwcPreferredMail |
| pwcCloudStatus | N/A | 8 | Does not exist in OneAD |
| PwCCoachEmpID | N/A | 100959910 | Does not exist in OneAD |
| pwccostcenter | departmentNumber | SEC002 | |
| PwCcountryCode | c | US | Contains custom PwC codes such as UK and codes for ACs. For pure ISO 3166 codes use pwcISOCountryCode |
| Pwcdepartment | departmentNumber | SEC002 | |
| PwCemployeeStatus | N/A | INAB Employee | Legacy Notes Value which is no longer used |
| PwCemployeestatuscode | N/A | 1840013 | Does not exist in OneAD |
| PwCemployeeType | employeeType | Employee | |
| pwcGCPCloudMail | N/A | Sally.staff@gcp.pwc.com | Specific attribute for GCP login |
| pwcGlobalGradeAbbreviatedName | N/A | Dir | Does not exist in OneAD. See title for non-abbreviated grade |
| pwcGlobalGradeCode | N/A | 1840261 | Does not exist in OneAD |
| pwcGlobalGradeName | title | Director | |
| pwcGlobalLoSL1AbbreviatedName | N/A | IFS | Does not exist in OneAD. See department for non-abbreviated LoS |
| pwcGlobalLoSL1Name | department | Internal Firm Services | |
| pwcGlobalNetworkCode | N/A | 12669382 | Does not exist in OneAD |
| pwcGlobalNetwork CompetencyCode | N/A | 12669328 | Does not exist in OneAD |
| pwcGlobalNetwork CompetencyName | pwcGlobalNetwork CompetencyName | IFS - Information (IT) | |
| pwcGlobalNetworkName | N/A | Internal Firm Services | Does not exist in OneAD |
| PwCGuidHistory | N/A | sstaff999-20080523125539Z | Legacy value no longer used |
| PwChireDate | pwcOriginalHireDate | 20220901000000+0000 | In OneAD format is YYYYMMDD |
| PwChrFamilyName | N/A | Staff | Does not exist in OneAD. See sn for surname from INAB |
| PwChrGivenName | N/A | Sally | Does not exist in OneAD. See givenName for given name from INAB |
| PwChrMiddleName | N/A | Jane | Does not exist in OneAD. |
| pwcIdentifier | N/A | S-1-5-21-1337251388- 3999962215-1789368555-5555 | Legacy value no longer used |
| PwCIndustryCode | N/A | 12685565 | Does not exist in OneAD |
| PwCJobCode | N/A | 203506 | Does not exist in OneAD |
| PwCJobCodeDesc | N/A | Cybersecurity - Identity and Access Management - Director - P | Does not exist in OneAD |
| pwcJobFamilyCode | N/A | 18869903 | Does not exist in OneAD |
| pwcJobFamilyGroup | N/A | 18869869 | Does not exist in OneAD |
| pwcJobFamilyName | N/A | Identity and Access | - JF |
| PwcJobTitle | N/A | INTMGR | Does not exist in OneAD |
| pwcLegacyUserID | sAMAccountName | sstaff999 | |
| pwcLocalLOSLevel1 | pwcLocalLOSLevel1 | PwC IT Services | |
| pwcLocalLOSLevel2 | pwcLocalLOSL2 | PwC ITSCo USA | |
| PwCLocation | l | ITSCO - Austin - 835 West 6th Street | |
| PwClocationcode | physicalDeliveryOfficeName | ITSCO - Austin - 835 West 6th Street | |
| PwClos | N/A | IFS | Does not exist in OneAD. See department for full LoS name |
| PwCnotesDN | N/A | CN=Sally Staff/OU=US/OU=GTS/O=PwC | Legacy value no longer used |
| PwCnotesDNAbbreviated | N/A | Sally Staff/US/GTS/PwC | Legacy value no longer used |
| PwCnotesDomain | N/A | INTL | Legacy value no longer used |
| pwcObjectSID | N/A | S-1-5-21-1337251388- 3999962215-1789368555-5555 | Legacy value no longer used |
| pwcPartyID | pwcPartyID | 6c699838-2c9c-492e-9c06-ef30111bf26z | |
| PwCportalCreatedDate | N/A | 20011122040539Z | Legacy value no longer used |
| PwCportalModifiedDate | N/A | 20020621134933Z | Legacy value no longer used |
| PwCPortalUserStatus | N/A | Active | Legacy value no longer used |
| PwCPPI | pwcPPI | 1000777777 | |
| PwCPreferredContactMethod | N/A | CellPhoneNumber | Legacy value no longer used |
| PwCpreferredContactPhone | N/A | (813) 555-9800 | Legacy value no longer used |
| pwcPreferredMail | Sally.staff@pwc.com | ||
| PwCPreferredName | pwcPreferredName | Sally | |
| PwCRoleCode | N/A | 18869869 | Does not exist in OneAD |
| pwcservicelinedesc | pwcLocalLOSL2 | PwC ITSCo USA | |
| PwCstreet2 | N/A | Suite 1600 | Does not exist in OneAD |
| PwCSubLOSCode1 | pwcLocalLOSLevel1 | PwC IT Services | |
| PwCSubLOSCode2 | pwcLocalLOSL2 | PwC ITSCo USA | |
| PwCSubRoleCode | N/A | 18869903 | Does not exist in OneAD |
| PwCSubRoleCodeDesc | N/A | Identity and Access Management - JF | Does not exist in OneAD |
| PwCtheatre | N/A | Americas | Legacy value no longer used |
| pwcUserType | N/A | Internal | Does not exist in OneAD |
| pwcWorkerID | employeeNumber | 105555555 | Workday number if it exists for user |
| sn | sn | Staff | |
| st | st | US-TX | |
| street | street | 835 West 6th Street | |
| uid | sAMAccountName | sstaff999 | |
| uPwCAssignedOffice | l | ITSCO - Austin - 835 West 6th Street | |
| uPwcBu | department | Internal Firm Services | |
| uPwCdepartment | pwcCostCentreDescription | QW US ITSCo Security | |
| uPwCemployeeStatus | N/A | Active | Does not exist in OneAD |
| uPwCemployeeType | employeeType | Employee | |
| uPwCIndustry1 | N/A | Not Applicable | Legacy value no longer used |
| upwcjobtitle | N/A | Cybersecurity - Identity and Access Management - Director - PS | Does not exist in OneAD |
| upwclos | department | Internal Firm Services | |
| uPwCRole | N/A | Cybersecurity | Does not exist in OneAD |
| uPwCStaffClass | N/A | Dir | Does not exist in OneAD. See title for non-abbreviated grade |
| entryDN | distinguishedName | uid=sstaff999,L=Americas, ou=Internal,ou=People, dc=pwcglobal,dc=com | Different between OpenDJ and OneAD due to directory structure |
| entryUUID | objectGUID | 62a38740-0aae- 366b-bd0a-228cd9daff5b | System attribute that is different between OpenDJ and OneAD. |
Destination IP Addresses & Ports
| Environment | DNS Name | IP Addresses | Ports |
|---|---|---|---|
| Production | directory.pwcglb.com | N/A Please use DNS. All One AD is opened to 10.0.0.0/8 & 172.16.0.0/12 | 636 |
Support
For support, work with your dedicated regional PoD team.