ldap query of IBM i

I am looking for a ldap tool, preferably gui, which I can use to point to my IBM i ldap and search it.
The goal is to be able to search users, via ldap, and get the dates for last used and last signon.
I am having an issue with IBM Security Identity Manager (ISIM) where their Reports, Audit and Security Reports, Dormant Accounts report is reporting nonsensical dates for Last Accessed Date.

I have also tried this:
QSH
ldapsearch -h gdihq.corp.dekko.com -D os400-profile=ITIM -w redacted -b "os400-sys=GDIHQ.dekko-1" -s sub objectclass=OS400-usrprf
I get a list of users, but not a whole lot of attributes. For example:
os400-profile=QSECOFR,CN=ACCOUNTS,OS400-SYS=GDIHQ.DEKKO-1
OBJECTCLASS=top
OBJECTCLASS=os400-usrprf
OS400-PROFILE=QSECOFR

I tried going into http://gdihq:2001
Network, Servers, TCP/IP Servers, selecting IBM Tivoli Directory Server for IBM i
This did help me with one correction on that ldapsearch command but it doesn't list the attributes returned. I'm sure there's something like ldapsearch only returns certain columns by default and I need to directly ask for others.

I can't find "Schema management", but maybe I'm starting at the wrong url?: Expand Schema management in the navigation area and click Manage attributes.
https://www.ibm.com/support/knowledgecenter/ssw_ibm_i_74/rzahy/rzahyviewattr.htm

I'd rather try the GUI method as this is exhausting.
ldapsearch -h gdihq.corp.dekko.com -D os400-profile=ITIM -w redacted -b cn=schema -s base objectclass=* attributeTypes IBMAttributeTypes

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 7310 Innovation Blvd, Suite 104
Ft. Wayne, IN 46818
Ship to: 7310 Innovation Blvd, Dock 9C
Ft. Wayne, IN 46818
http://www.dekko.com