LDAP & Nested groups about ldap2pg HOT 7 CLOSED

We were able to work through this using the code I shared on Nov 9th comment - marking this completed

from ldap2pg.

hello. thanks for reaching

can you create server side views flattening groups structure ? this will performs better.

from ldap2pg.

I was able to get this to work using the server side flatten group id

- description: "Query LDAP to create superusers."
  ldap:
    base: OU=xxxxx,OU=xxxxx,DC=xxxxx,DC=com
    filter: "(memberOf:1.2.840.113556.1.4.1941:=CN=GROUP_of_GROUPS,OU=xxxxx,OU=xxxxx,DC=xxxxx,DC=com)"
    attribute: sAMAccountName
  grant:
    privilege: grant_personal_account_role
    role: '{sAMAccountName}'
  roles:
  - name: '{sAMAccountName}'
    options: LOGIN SUPERUSER
    comment: '{Name} From LDAP group GROUP_of_GROUPS '

from ldap2pg.

Thanks for the feedback.

note that attribute is already computed from {...} in rules.
See verbose logs with normalized configuration.

from ldap2pg.

Hi bersace - Can you elaborate what you mean? Are you stating that I do not need to specify attribute? I used verbose a lot to debug my problems as it took a while to get a proper search criteria.

from ldap2pg.

Hi bersace - Can you elaborate what you mean? Are you stating that I do not need to specify attribute?

Yes. attribute is infered from templating.

 - description: "Query LDAP to create superusers."
   ldap:
     base: OU=xxxxx,OU=xxxxx,DC=xxxxx,DC=com
     filter: "(memberOf:1.2.840.113556.1.4.1941:=CN=GROUP_of_GROUPS,OU=xxxxx,OU=xxxxx,DC=xxxxx,DC=com)"
-    attribute: sAMAccountName
   grant:

from ldap2pg.

I've solved it like this, ldap2pg version 6.0.0 .

As this is was a test, it's not important that the base and filter are exposed.

- description: "Query LDAP to create roles."
  ldapsearch:
    base: DC=libvirt,DC=lan
    filter: "(&(memberOf:1.2.840.113556.1.4.1941:=CN=TestAll,DC=libvirt,DC=lan)(objectClass=person))"
  role:
  - name: '{sAMAccountName}'
    options: LOGIN
    comment: 'From LDAP group {dn}'
    parent: "writers"

from ldap2pg.