28
edits
User Management: Difference between revisions
no edit summary
Tom.Wegener (talk | contribs) (mention update limitations for the role permission system) |
No edit summary |
||
| Line 191: | Line 191: | ||
The group filter requires either '''%s''' as a placeholder for the username, or any '''${value}''' attribute of the user. The special value '''${DN}''' references the distinguished name of the user. | The group filter requires either '''%s''' as a placeholder for the username, or any '''${value}''' attribute of the user. The special value '''${DN}''' references the distinguished name of the user. | ||
In the ''' | In the '''group mapping''' section, LDAP groups can be mapped to roles. | ||
For any of the roles, a comma-separated list of the common name of the groups can be defined. If the user is in any of the groups, they are allowed to log in and will have the permissions of the given role. | |||
Example for a simple LDAP setup involving only the username: | Example for a simple LDAP setup involving only the username: | ||
| Line 199: | Line 199: | ||
User filter : (uid=%s) | User filter : (uid=%s) | ||
Group filter : (memberUid=%s) | Group filter : (memberUid=%s) | ||
Group mapping: | |||
admin : allegro-mm-admins | |||
user : allegro-mm-users | |||
capture: | |||
In this example, the user can log in if he is in LDAP group allegro-mm-admins or allegro-mm-users. No group mapping is given for the capture role, so no LDAP user will be assigned to this role. | |||
==== '''Active Directory''' ==== | ==== '''Active Directory''' ==== | ||
| Line 206: | Line 210: | ||
User filter : (&(sAMAccountName=%s)(objectCategory=person)(objectClass=user)(!sAMAccountType=805306370)(!userAccountControl:1.2.840.113556.1.4.803:=2)) | User filter : (&(sAMAccountName=%s)(objectCategory=person)(objectClass=user)(!sAMAccountType=805306370)(!userAccountControl:1.2.840.113556.1.4.803:=2)) | ||
Group filter : (&(member=${DN})(objectClass=group)) | Group filter : (&(member=${DN})(objectClass=group)) | ||
Group mapping: | |||
admin: allegro-mm-admins | |||
user : allegro-mm-users | |||
A more complex group filter, using pre-filtering groups for performance reasons in large directories with lots of groups: | A more complex group filter, using pre-filtering groups for performance reasons in large directories with lots of groups: | ||