LDAP Authentication with Group Membership | Community
Skip to main content
D
DKWilliams
New Participant
October 16, 2015
Solved

LDAP Authentication with Group Membership

  • October 16, 2015
  • 1 reply
  • 842 views

I am in the process of setting up authentication via Active Directory LDAP.  I have it working just fine for everyone in my AD to log in to CQ5, but I actually have about 1000 AD users and only 10 of my developers will be using CQ, at least in our test phase.  I would like the authentication process to only create new users in CQ based on their membership in an AD group.  Is this possible?  How do I define that within my LDAP_Login.conf file?  I have tried a couple of settings, and I either get no one able to log in, or everyone able to log in.  My AD tree is also very departmentalized, so I can't put everyone who is going to use the software in one directory, although I have created a group for these 10 developers that I can put put anywhere in the tree (right now it is at the root, i.e., "CN=CMS_Users,OU=CAES,DC=CAESAD,DC=UGA,DC=EDU"

Here is what I have at present:

              userRoot="OU=CAES,DC=CAESAD,DC=UGA,DC=EDU"
              userFilter="(objectclass=person)"
              userIdAttribute="sAMAccountName"

              groupRoot="OU=CAES,DC=CAESAD,DC=UGA,DC=EDU"
              groupMembershipAttribute="uniquemember"

              autocreate="create"
              autocreate.user.mail="profile/email"
              autocreate.user.givenname="profile/givenName"
              autocreate.user.familyname="profile/sn"
              autocreate.user.cn="rep:fullname"
              autocreate.user.sn="cq:last-name"
              autocreate.user.description="profile/aboutMe     
              autocreate.path="splitdn"
              cache.expiration="600"
              cache.maxsize="100";

 

Thanks!

Diana

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by Yogesh_Upadhyay

Diana,

For that you might have to wither extend login module and use your own on top of LDAP one (And let that module create user or group) or use http://wem.help.adobe.com/enterprise/en_US/10-0/core/administering/ldap_authentication.html#Callbacks feature. In this you can disable User sync and then use only Group sync to create user.

Yogesh

1 reply

Yogesh_Upadhyay
Yogesh_UpadhyayAccepted solution
New Participant
October 16, 2015

Diana,

For that you might have to wither extend login module and use your own on top of LDAP one (And let that module create user or group) or use http://wem.help.adobe.com/enterprise/en_US/10-0/core/administering/ldap_authentication.html#Callbacks feature. In this you can disable User sync and then use only Group sync to create user.

Yogesh

Terms & ConditionsAccessibility statement

Loading footer...