Admin Role with LDAP

Confluence User - 28 Jul, 2021

HI,

I am currently trialling Joget Enterprise and am trying to setup LDAP Directory Manager with Active Directory against the root domain of our forest.  As a proof of concept I am trying to permit users from multiple child domains to login so have tried using for example DC=contoso,DC=com for most DNs (I have narrowed it down to specific OUs during troubleshooting) and utilised extensionAttribute7 to specify whether a user is licensed or not (0 or 1).

Through this I have users logging in (though some supposedly licensed users are refused for not having a license despite authenticating successfully) and the credentials used for LDAP admin are refused login with incorrect username\password (I have read on some other posts that one of the other LDAP manager plugins permits both a local and LDAP user model so I may try this at some point).

My biggest issue though is that I do not seem to be able to find the correct configuration for the Admin Role page in order to elevate some of my LDAP users to an Admin Role.  So far I have tried the following:

  • Specify an OU containing the desired Admin user(s)
  • Adding a search filter to the above to select a single user
  • Specify an OU containing only a Security Group whose members are the desired admin(s) with the Attribute Mapping - Users and Map to LDAP User Entry Primary Attribute specified
  • Added a search filter to the above to select the sole Security Group in the OU
  • Added different users into the above Security Group (normal users and\or the LDAP Admin user for instance)

Unfortunately they do not appear to have an impact and the users remain with the standard role or in the case of the LDAP admin user, are still unable to login.  The debug log reports successful authentication for all LDAP users (except the LDAP Admin user) and reports that LDAP users are otherwise checked to see if they are an admin but not whether or not this is determined to be true.  These are interspersed with a large number of the default 'admin not found in LDAP' errors related to me making changes under the default user whilst testing.

Any help would be appreciated.


Thanks.

ldap

3


29 Jul, 2021
confluenceUser
1
confluenceUser

Hi, you did not specify your sample configuration so it would be difficult to guess where you went wrong. This is my sample configuration which maps the Admin Role to all users in a specific group:

Admin Role Base DN: CN=Joget Admins,CN=Users,DC=windows,DC=local
Admin Role Import Search Filter: (objectClass=group)
Attribute Mapping - Users: member
Map To LDAP User Entry Primary Attribute: distinguishedName


29 Jul, 2021
confluenceUser
confluenceUser

Hi,

I had tried several different configurations so described them rather than detail each one.  I can't recall now whether one of those I tried was to specify the Security Group itself as the Admin Role Base DN (I think I may have only tried specifying the OU where the Security Group resides and using the Search Filter to select it).  Otherwise my tests had been pretty much the same as your sample, I'll try this and let you know the result.

Regards.

29 Jul, 2021
confluenceUser
confluenceUser

Hi,

After specifying the DN of the Group for the Admin Role Base DN and allowing sufficient time for the relevant changes to replicate amongst our DCs it finally worked.

Thanks.

RELATED QUESTIONS

Your answer


To answer a question you'll need an account.

Print