LDAP best practices for filtering users and roles
Usually you only want to retrieve a subset of users and roles present in your LDAP, to be shown in user interface lists or to be able to log in.
Example based on a single LDAP group
Section titled “Example based on a single LDAP group”- Create a group named OpenKM (CN=OpenKM,CN=users,DC=company,DC=com). It will be used for filtering users and roles.
- Assign roles and users as members of the OpenKM group.
- Goal: only users and roles that are members of the OpenKM group will be displayed in user interface lists.
For filtering the user interface:
| Field / Property | Type | Description |
|---|---|---|
| principal.ldap.user.search.filter | String | (&(objectclass=person)(memberOf=CN=OpenKM,CN=users,dc=company,dc=com)) |
| principal.ldap.role.search.filter | String | (&(objectclass=group)(memberOf=CN=OpenKM,CN=users,dc=company,dc=com)) |
| principal.ldap.users.by.role.search.filter | String | (&(objectclass=group)(cn={0})(memberOf=CN=OpenKM,CN=users,dc=company,dc=com)) |
| principal.ldap.roles.by.user.search.filter | String | (&(objectClass=person)(sAMAccountName={0})(memberOf=CN=OpenKM,CN=users,dc=company,dc=com)) |
For login restrictions:
Modify openkm.properties with:
ldap.user.search.filter=(&(sAMAccountName={0})(memberOf=CN=OpenKM,CN=users,DC=company,DC=com))>If you use openkm.xml, then use:
<module-option name="baseFilter">(&(sAMAccountName={0})(memberOf=CN=OpenKM,CN=users,DC=company,DC=com))>Example based on the ROLE_USER and ROLE_ADMIN groups
Section titled “Example based on the ROLE_USER and ROLE_ADMIN groups”- Create a group named OpenKM (CN=OpenKM,CN=users,DC=company,DC=com). It will be used for filtering roles.
- Assign roles as members of the OpenKM group.
- Goal: only roles that are members of the OpenKM group will be displayed in user interface lists.
- Goal: only users who are members of the ROLE_USER or ROLE_ADMIN groups will be displayed in user interface lists.
For filtering the user interface:
| Field / Property | Type | Description |
|---|---|---|
| principal.ldap.user.search.filter | String | (&(objectclass=person) (|(memberOf=cn=ROLE_USER,cn=users,dc=company,dc=com)(memberOf=cn=ROLE_ADMIN,cn=users,dc=company,dc=com))) |
| principal.ldap.role.search.filter | String | (&(objectclass=group)(memberOf=cn=OpenKM,dc=company,dc=com)) |
| principal.ldap.users.by.role.search.filter | String | (&(objectClass=group)(cn={0})(memberOf=cn=OpenKM,cn=users,DC=company,DC=com)) |
| principal.ldap.roles.by.user.search.filter | String | (&(objectClass=person)(sAMAccountName={0})(memberOf=cn=OpenKM,cn=users,DC=company,DC=com)) |
For login restrictions:
Modify openkm.properties with:
ldap.user.search.filter=(&(sAMAccountName={0})(objectClass=person)(|(memberOf=CN=ROLE_USER,CN=users,dc=weyler,dc=local)(memberOf=CN=ROLE_ADMIN,CN=users,dc=weyler,dc=local)))If you use openkm.xml, then use:
<module-option name="baseFilter">(&(sAMAccountName={0})(objectClass=person)(|(memberOf=CN=ROLE_USER,CN=users,dc=weyler,dc=local)(memberOf=CN=ROLE_ADMIN,CN=users,dc=weyler,dc=local)))