LDAP best practices for filtering users and roles

Usually you only want to retrieve a subset of users and roles present in your LDAP, to be shown in user interface lists or be able to login into.

Example based on single LDAP group

• Create a group named OpenKM (CN=OpenKM,CN=users,DC=company,DC=com). It will be used for filtering users and roles purpose.
• Assign roles and users are members of OpenKM group.
• Goal, only users and roles which are members of OpenKM group will be displayed in user interface lists.

For filtering user interface:

For login restriction:

Modify OpenKM.xml with:

<module-option name="baseFilter">(&(sAMAccountName={0})(memberOf=CN=OpenKM,CN=users,DC=company,DC=com))>

Example based on ROLE_USER and ROLE_ADMIN group

• Create group name OpenKM (CN=OpenKM,CN=users,DC=company,DC=com). It will be used for filtering roles purpose.
• Assign roles are members of OpenKM group.
• Goal, only roles with OpenKM role will be displayed in user interface lists.
• Goal, only users what are members of ROLE_USER or ROLE_ADMIN group will be displayed in user interface lists.

For filtering user interface:

For login restriction:

Modify OpenKM.xml with:

(&(sAMAccountName={0})(objectClass=person)(|(memberOf=CN=ROLE_USER,CN=users,dc=weyler,dc=local)(memberOf=CN=ROLE_ADMIN,CN=users,dc=weyler,dc=local)))