<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Interesting.
<div class=""><br class="">
</div>
<div class="">Thanks for the update. See below.</div>
<div class=""><br class="">
<div>
<blockquote type="cite" class="">
<div class="">On 6 Aug 2014, at 5:47 pm, Josh Moore <<a href="mailto:josh@glencoesoftware.com" class="">josh@glencoesoftware.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class=""><br class="">
On Aug 5, 2014, at 9:42 PM, Jake Carroll wrote:<br class="">
<br class="">
<blockquote type="cite" class="">Hi all.<br class="">
</blockquote>
<br class="">
Hi Jake,<br class="">
<br class="">
<blockquote type="cite" class="">On 5 Aug 2014, at 11:29 pm, Josh Moore <<a href="mailto:josh@glencoesoftware.com" class="">josh@glencoesoftware.com</a><<a href="mailto:josh@glencoesoftware.com" class="">mailto:josh@glencoesoftware.com</a>>> wrote:<br class="">
<br class="">
On Aug 5, 2014, at 3:22 PM, Aleksandra Tarkowska wrote:<br class="">
<br class="">
And one add on question: is this Active Directory?<br class="">
<br class="">
Because this *IS* AD based (and we are hooking up to the LDAP semantics of it (because they won’t let us chat native AD to it for security reasons…), we can’t “see” the secondary internal container inside it. All we see is people in the above OU. We don’t “see”
that container and (from what I can see) we can’t traverse into it, because all LDAP sees is a flat bind DN like the ou= string I showed you above.<br class="">
<br class="">
So - the question is, is there any way around it, or do I need some kind of magical binddn that takes into account sub-containers?<br class="">
</blockquote>
<br class="">
The text regarding AD that will be added to the 5.0.3 release docs this week(*) is:<br class="">
<br class="">
---------------------------<br class="">
Active Directory (AD) supports a form of LDAP and can be used by OMERO like most other directory services.<br class="">
<br class="">
In AD, the Domain Services (DS) ‘forest’ is a complete instance of an Active Directory which contains one or more domains. Querying a particular Domain Service will yield results which are local to that domain only. In an environment with just one domain it
is possible to use the default configuration instructions for OMERO LDAP. If there are multiple domains in the forest then it is necessary to query the Global Catalogue to enable querying across all of them.<br class="">
<br class="">
Global Catalogue<br class="">
<br class="">
In an AD DS forest, a Global Catalogue provides a central repository of all the domain information from all of the domains. This can be queried in the same way as a specific Domain Service using LDAP, but it runs on different ports; 3268 and 3269 (SSL).<br class="">
<br class="">
LDAP AD Global Catalogue server URL string<br class="">
<br class="">
bin/omero config set omero.ldap.urls <a href="ldap://ldap.example.com:3268" class="">
ldap://ldap.example.com:3268</a><br class="">
<br class="">
Note: A SSL URL above should look like this: <a href="ldaps://ldap.example.com:3269" class="">
ldaps://ldap.example.com:3269</a><br class="">
</div>
</blockquote>
<div><br class="">
</div>
<div>I actually solved it by using an LDAP “OR” syntax (|) like this:</div>
<div><br class="">
</div>
<div><span style="color: rgb(41, 249, 20); font-family: 'Andale Mono'; background-color: rgb(0, 0, 0);" class="">omero.ldap.user_filter=(|(ou=Queensland Brain Institute)(ou=Ageing Dementia Research))</span></div>
<div><br class="">
</div>
<div>All good :).</div>
<div><br class="">
</div>
<div>You might want to write some docco around compound filters and the other operators (such as ((|)) at some point to do what I’ve done here, to granularly allow concentric “rings” of more and more OU’s granular access to Omero.</div>
<div><br class="">
</div>
<div><br class="">
</div>
<div>Thanks guys!</div>
<div><br class="">
</div>
<div>-jc</div>
<br class="">
<blockquote type="cite" class="">
<div class="">---------------------------<br class="">
<br class="">
Hopefully that will work for you.<br class="">
<br class="">
<br class="">
(*): Once available, see<br class="">
<a href="https://www.openmicroscopy.org/site/support/omero5/sysadmins/server-ldap.html?highlight=active" class="">https://www.openmicroscopy.org/site/support/omero5/sysadmins/server-ldap.html?highlight=active</a> directory#active-directory<br class="">
<br class="">
<br class="">
<blockquote type="cite" class="">Thanks.<br class="">
-jc<br class="">
</blockquote>
<br class="">
Cheers,<br class="">
~Josh<br class="">
<br class="">
<blockquote type="cite" class="">From: Jake Carroll <<a href="mailto:jake.carroll@uq.edu.au" class="">jake.carroll@uq.edu.au</a><<a href="mailto:jake.carroll@uq.edu.au" class="">mailto:jake.carroll@uq.edu.au</a>><<a href="mailto:jake.carroll@uq.edu.au" class="">mailto:jake.carroll@uq.edu.au</a>>><br class="">
Date: Tue, 5 Aug 2014 11:11:27 +0000<br class="">
To: "<a href="mailto:ome-users@lists.openmicroscopy.org.uk" class="">ome-users@lists.openmicroscopy.org.uk</a><<a href="mailto:ome-users@lists.openmicroscopy.org.uk" class="">mailto:ome-users@lists.openmicroscopy.org.uk</a>><<a href="mailto:ome-users@lists.openmicroscopy.org.uk" class="">mailto:ome-users@lists.openmicroscopy.org.uk</a>>"
<<a href="mailto:ome-users@lists.openmicroscopy.org.uk" class="">ome-users@lists.openmicroscopy.org.uk</a><<a href="mailto:ome-users@lists.openmicroscopy.org.uk" class="">mailto:ome-users@lists.openmicroscopy.org.uk</a>><<a href="mailto:ome-users@lists.openmicroscopy.org.uk" class="">mailto:ome-users@lists.openmicroscopy.org.uk</a>>><br class="">
Subject: [ome-users] Weird LDAP issue - subtree/forest can't auth?<br class="">
<br class="">
Hi all.<br class="">
<br class="">
Just a quick LDAP/auth question.<br class="">
<br class="">
I've got an LDAP schema and hierarchy that seemed to be working quite well with Omero up until we tried to auth somebody who was a sub OU of my OU.<br class="">
<br class="">
Anyone in the top-level container of the OU can auth perfectly, but people INSIDE that, inside another OU (within my OU) are having problems. Ostensibly, it should work, as they are part of the one larger container - but they happen to be "enclosed" within
another LDAP base (within the primary base).<br class="">
<br class="">
Any ideas why Omero doesn't like this and what I can do about it in terms of LDAP config within Omero? Does this involve compound filters or is there a way to match multiple bind DN's or some such?<br class="">
<br class="">
Thanks, all!<br class="">
<br class="">
-jc<br class="">
<br class="">
</blockquote>
<br class="">
</div>
</blockquote>
</div>
<br class="">
<div apple-content-edited="true" class=""><span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px;">----------<br class="">
Jake Carroll --- Information Technology Manager<br class="">
The Queensland Brain Institute, The University of Queensland, Australia<br class="">
E:<span class="Apple-tab-span" style="white-space: pre; "> </span><a href="mailto:jake.carroll@uq.edu.au" class="">jake.carroll@uq.edu.au</a><br class="">
P: <span class="Apple-tab-span" style="white-space: pre; "> </span>+61 7 334 66407<br class="">
M: <span class="Apple-tab-span" style="white-space: pre; "> </span>0402739157<br class="">
<br class="">
"We are shaped by our thoughts, we become what we think. When the mind is pure, joy follows like a shadow that never leaves" - Buddha.</span>
</div>
<br class="">
</div>
</body>
</html>