hi joern,
i have the same configuration like you (memberOf) in file
config-security-overrides.properties:
ldapUserContextMapper.mapping[privilege]=memberOf,ICG4
ldapUserContextMapper.mapping[profile]=profile,RegisteredUser
but i have also changed the config in file config-security.properties to
define a synchronization of the ldap groups with geonetwork each night
(then all the groups of ldap will be created in the geonetwork db (in
table groups) )
ldap.sync.cron=0 23 12 * * ?
ldap.sync.startDelay=60000
ldap.sync.user.search.base=${ldap.base.search.base}
ldap.sync.user.search.filter=(objectClass=person)
ldap.sync.user.search.attribute=sAMAccountName
ldap.sync.group.search.base=cn=Users
ldap.sync.group.search.filter=(objectClass=group)
ldap.sync.group.search.attribute=distinguishedName
ldap.sync.group.search.pattern=(.*)
(this depends on your ldap config)
it is also possible to create the group ad hoc when the user is logging
in (ldap.privilege.create.nonexisting.groups=true in same file (the
config to retrieve the groups from ldap is still used from the sync config))
gruss juergen
On 29/04/15 08:47, joernahlers [via OSGeo.org] wrote:
hi,
i have the same Problem. The login works great, but the user group is only
the fallback and the group mapping for the active directory groups didn't
work. For the mapping i want to use the memberOf field.
This is my config-security-overrides.properties:
CN# Map user information to LDAP attributes and default values
ldapUserContextMapper.mapping[name]=givenName,
ldapUserContextMapper.mapping[surname]=sn,
ldapUserContextMapper.mapping[mail]=mail,data@anonymised.com
ldapUserContextMapper.mapping[organisation]=company,myorganization
ldapUserContextMapper.mapping[kind]=title,
ldapUserContextMapper.mapping[address]=streetAddress,
ldapUserContextMapper.mapping[zip]=postalCode,
ldapUserContextMapper.mapping[state]=,
ldapUserContextMapper.mapping[city]=l,
ldapUserContextMapper.mapping[country]=,
ldapUserContextMapper.mapping[privilege]=memberOf,
# If not set, the default profile is RegisteredUser
# Valid profiles are
http://geonetwork-opensource.org/manuals/trunk/eng/developer/apidocs/geonetwork/org/fao/geonet/constants/Geonet.Profile.html
ldapUserContextMapper.mapping[profile]=memberOf,Guest
# Map LDAP custom profiles to catalog profiles. Not used if
ldap.privilege.pattern is defined.
ldapUserContextMapper.profileMapping[CN=ADMINISTRATOREN,DC=my,DC=org]=Administrator
_______________________________________________
If you reply to this email, your message will be added to the discussion below:
http://osgeo-org.1560.x6.nabble.com/geonetwork-ldap-tp5188420p5203398.html
To unsubscribe from geonetwork ldap, visit http://osgeo-org.1560.x6.nabble.com/template/NamlServlet.jtp?macro=unsubscribe_by_code&node=5188420&code=ai5zb3JnQGZ6LWp1ZWxpY2guZGV8NTE4ODQyMHwtNDYwODM4MTE3
smime.p7s (6K) <http://osgeo-org.1560.x6.nabble.com/attachment/5203431/0/smime.p7s>
--
View this message in context: http://osgeo-org.1560.x6.nabble.com/geonetwork-ldap-tp5188420p5203431.html
Sent from the GeoNetwork users mailing list archive at Nabble.com.