LDAP Group Mapping Type

When the LDAP login handler signs a user in, it decides which Exponential user groups the account belongs to. ldap.ini [LDAPSettings] LDAPGroupMappingType chooses how, in one of three ways. A user for whom no group is found goes to the default group of LDAPUserGroup[].

Groups are looked for, and created, below the node of LDAPGroupRootNodeId (5, the Users node, as shipped). With KeepGroupAssignment=enabled an administrator can move an LDAP user to another group without the next sign-in moving it back.

UseGroupAttribute

The user entry has an attribute, named in LDAPUserGroupAttribute, with one value per group. LDAPUserGroupAttributeType says what the values are:

[LDAPSettings]
LDAPGroupMappingType=UseGroupAttribute
LDAPUserGroupAttribute=employeetype
LDAPUserGroupAttributeType=name
LDAPCreateMissingGroups=disabled

With the directory entries uid: janedoe, employeetype: Editors and uid: johndoe, employeetype: Editors, employeetype: Technical writers, Jane is placed in Editors and John in Editors and Technical writers. A group that does not exist is created when LDAPCreateMissingGroups=enabled; otherwise the user goes to the default group.

SimpleMapping

The group entries of the directory have a member attribute that holds the DNs of their members (for example groupOfNames with member). The handler searches below LDAPGroupBaseDN for entries of the object class LDAPGroupClass whose LDAPGroupMemberAttribute contains the user's DN, reads their name from LDAPGroupNameAttribute, and maps it with LDAPUserGroupMap[] to the name of an existing Exponential group.

[LDAPSettings]
LDAPGroupMappingType=SimpleMapping
LDAPGroupBaseDN=ou--groups,dc--example,dc--com
LDAPGroupClass=groupOfNames
LDAPGroupNameAttribute=cn
LDAPGroupMemberAttribute=member
LDAPUserGroupMap[]
LDAPUserGroupMap[editor]=Editors
LDAPUserGroupMap[techwriter]=Technical writers

With the group entries cn: editor, member: uid=janedoe,ou=people,dc=example,dc=com, member: uid=johndoe,ou=people,dc=example,dc=com and cn: techwriter, member: uid=johndoe,ou=people,dc=example,dc=com, Jane is placed in Editors and John in Editors and Technical writers. Directory groups without an entry in the map are ignored, and no group is created.

The settings are LDAPGroupClass, LDAPGroupNameAttribute and LDAPGroupMemberAttribute. An example on an earlier version of this page used the names LDAPUserGroupClass and LDAPUserGroupAttribute instead, which this mode does not read; that is why it did not work.

GetGroupsTree

Like SimpleMapping, the membership is read from the group entries (LDAPGroupBaseDN, LDAPGroupClass, LDAPGroupNameAttribute, LDAPGroupMemberAttribute), but groups are followed upwards: a group that is a member of another group is placed below it. The handler creates the groups it does not find below LDAPGroupRootNodeId, with the names of the directory and an empty description (LDAPGroupDescriptionAttribute is read but not stored). No map is needed.

[LDAPSettings]
LDAPGroupMappingType=GetGroupsTree
LDAPGroupBaseDN=ou--groups,dc--example,dc--com
LDAPGroupClass=groupOfNames
LDAPGroupNameAttribute=cn
LDAPGroupMemberAttribute=member

Troubleshooting

Set LDAPDebugTrace=enabled on a test system and sign in: step 4/5 of the debug output shows the mapping type, the default group and the groups found. A user who signs in but lands in the default group usually means the member attribute holds plain user names while the handler searches for the DN, or the group names do not match the map.