LDAP best practices for filtering users and roles

Usually you only want to retrieve a subset of users and roles present in your LDAP, to be shown in user interface lists or to be able to log in.

Example based on a single LDAP group

• Create a group named OpenKM (CN=OpenKM,CN=users,DC=company,DC=com). It will be used for filtering users and roles.
• Assign roles and users as members of the OpenKM group.
• Goal: only users and roles that are members of the OpenKM group will be displayed in user interface lists.

For filtering the user interface:

For login restrictions:

Modify openkm.properties with:

ldap.user.search.filter=(&(sAMAccountName={0})(memberOf=CN=OpenKM,CN=users,DC=company,DC=com))>

If you use openkm.xml, then use:

<module-option name="baseFilter">(&amp;(sAMAccountName={0})(memberOf=CN=OpenKM,CN=users,DC=company,DC=com))>

Example based on ROLE_USER and ROLE_ADMIN groups

• Create a group named OpenKM (CN=OpenKM,CN=users,DC=company,DC=com). It will be used for filtering roles.
• Assign roles as members of the OpenKM group.
• Goal: only roles in the OpenKM group will be displayed in user interface lists.
• Goal: only users that are members of the ROLE_USER or ROLE_ADMIN groups will be displayed in user interface lists.

For filtering the user interface:

For login restrictions:

Modify openkm.properties with:

ldap.user.search.filter=(&(sAMAccountName={0})(objectClass=person)(|(memberOf=CN=ROLE_USER,CN=users,dc=weyler,dc=local)(memberOf=CN=ROLE_ADMIN,CN=users,dc=weyler,dc=local)))

If you use openkm.xml, then use:

<module-option name="baseFilter">(&amp;(sAMAccountName={0})(objectClass=person)(|(memberOf=CN=ROLE_USER,CN=users,dc=weyler,dc=local)(memberOf=CN=ROLE_ADMIN,CN=users,dc=weyler,dc=local)))