Filtering Active Directory Group Memebership
PostPosted:Sat Jun 28, 2014 10:29 am
After spending quite a bit of time running through the LDAP/AD examples on the WIKI I have successfully gotten Active Directory working. However I am having a problem with the list of roles.
My settings match LDAP-example3, however when I go to the "Users" list in administration the table shows the complete list of group membership for the user. Due to the security requirements of the network one user may be part of as many as 30 Role or Access groups.
I am hoping that there is something obvious that I am missing but after comparing line by line to the example and finding differences only in the OU/DC names I am stumped.
Any assistance would be appreciated.
My settings match LDAP-example3, however when I go to the "Users" list in administration the table shows the complete list of group membership for the user. Due to the security requirements of the network one user may be part of as many as 30 Role or Access groups.
I am hoping that there is something obvious that I am missing but after comparing line by line to the example and finding differences only in the OU/DC names I am stumped.
Any assistance would be appreciated.
Code: Select all
Settings:
principal.ldap.mail.attribute String mail
principal.ldap.mail.search.base String DC=MYDOM,DC=PARENTDOM,DC=TLD
principal.ldap.mail.search.filter String (&(objectclass=person)(sAMAccountName={0}))
principal.ldap.referral String follow
principal.ldap.role.attribute String cn
principal.ldap.role.search.base List OU=OpenKM,OU=Resources,OU=Security Groups,OU=CHIP, DC=MYDOM,DC=PARENTDOM,DC=TLD
principal.ldap.role.search.filter String objectclass=group
principal.ldap.roles.by.user.attribute String memberOf
principal.ldap.roles.by.user.search.base String DC=MYDOM,DC=PARENTDOM,DC=TLD
principal.ldap.roles.by.user.search.filter String (&(objectClass=user)(sAMAccountName={0}))
principal.ldap.security.credentials String *************************
principal.ldap.security.principal String CN=OpenKM LDAP Account,OU=Service Accounts,OU=CHIP IT, DC=MYDOM,DC=PARENTDOM,DC=TLD
principal.ldap.server String ldap://***.***.***.11
principal.ldap.user.attribute String sAMAccountName
principal.ldap.user.search.base List DC=MYDOM,DC=PARENTDOM,DC=TLD
principal.ldap.user.search.filter String (&(objectclass=user) (|(memberOf=CN=ROLE_USER,OU=OpenKM,OU=Resources,OU=Security Groups,OU=CHIP, DC=MYDOM,DC=PARENTDOM,DC=TLD)(memberOf=CN=ROLE_ADMIN,OU=OpenKM,OU=Resources,OU=Security Groups,OU=CHIP, DC=MYDOM,DC=PARENTDOM,DC=TLD)))
principal.ldap.username.attribute String cn
principal.ldap.username.search.base String DC=MYDOM,DC=PARENTDOM,DC=TLD
principal.ldap.username.search.filter String (sAMAccountName={0})
principal.ldap.users.by.role.attribute String member
principal.ldap.users.by.role.search.base String DC=MYDOM,DC=PARENTDOM,DC=TLD
principal.ldap.users.by.role.search.filter String (&(objectClass=group)(cn={0}))
principal.ldap.users.from.roles Boolean Inactive