<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Hi all,</p>
<p><br>
</p>
<p>I've set up LDAP authentication, the basic case where all users are added to one default group works ok. This is probably enough for our unit. However, there is another use case where it would be necessary to divide users according to research groups. Previously
we used a plugin, but I'd like to check with you first if it's possible to get the desired result with the improved LDAP support.</p>
<p><br>
</p>
<p>The LDAP groups we use look like this, we can administer them in a system called "Alma":</p>
<p><br>
</p>
<p></p>
<div>ldapsearch -H ldaps://ldap-internal.it.helsinki.fi:636 -x -s sub -b ou=alma_workgroups,ou=groups,o=hy "(&(uid=grp-A91900-lmu-cust))"</div>
<div>#</div>
<p></p>
<p></p>
<div># grp-A91900-lmu-cust, alma_workgroups, groups, hy</div>
<div>dn: uid=grp-A91900-lmu-cust,ou=alma_workgroups,ou=groups,o=hy</div>
<div>objectClass: hyGroup</div>
<div>objectClass: top</div>
<div>objectClass: groupOfUniqueNames</div>
<div>hyAccountingCode: A91900</div>
<div>hyCnSV: LMU-customers</div>
<div>hyCnEN: LMU-customers</div>
<div>uid: grp-A91900-lmu-cust</div>
<div>cn: LMU-customers</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', NotoColorEmoji, 'Segoe UI Symbol', 'Android Emoji', EmojiSymbols; font-size: 16px;">
uniqueMember: uid=foobar,dc=helsinki,dc=fi</div>
</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', NotoColorEmoji, 'Segoe UI Symbol', 'Android Emoji', EmojiSymbols; font-size: 16px;">
uniqueMember: uid=foobaq,dc=helsinki,dc=fi</div>
<div><br>
</div>
<div><br>
</div>
<div>Users can be members or owners of these groups:</div>
<div><br>
</div>
<div>
<div>ldapsearch -H ldaps://ldap-internal.it.helsinki.fi:636 -s sub -b dc=helsinki,dc=fi -x "(&(uid=hajaalin)(hyGroupOwnerships=uid=grp-A91900-lmu-cust,ou=alma_workgroups,ou=groups,o=hy))" </div>
<div></div>
<div>#</div>
<div><span style="font-size: 12pt;">hyGroupOwnerships: uid=grp-A91900-lmuisa_,ou=alma_workgroups,ou=groups,o=hy</span><br>
</div>
<div><span style="font-size: 12pt;">hyGroupOwnerships: uid=grp-A91900-lmu-cust,ou=alma_workgroups,ou=groups,o=hy</span><br>
</div>
<div><span style="font-size: 12pt;">
<div>hyGroupMemberships: uid=grp-A91900-lmu-staff,ou=alma_workgroups,ou=groups,o=hy</div>
<div><span style="font-size: 12pt;">hyGroupMemberships: uid=GRP-A00000-All,ou=groups,o=hy</span><br>
</div>
</span></div>
<div><br>
</div>
<br>
</div>
<div>This way I can restrict access to the appropriate groups, this is the part I'm happy with for our unit:</div>
<div>
<div>omero.ldap.user_filter=(|(hyGroupMemberships=uid=grp-A91900-lmu-cust,ou=alma_workgroups,ou=groups,o=hy)(hyGroupOwnerships=uid=grp-A91900-lmu-cust,ou=alma_workgroups,ou=groups,o=hy))</div>
<div><br>
</div>
</div>
<div><br>
</div>
But then to the more complicated use case. If I set </div>
<div>omero.ldap.new_user_group:attribute:hyGroupMemberships,</div>
<div>a whole bunch of groups will be created, but only one is relevant (the one indicating the research group), so somehow I should use :filtered_attribute:. So far I have tried using the same filter as for users:</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', NotoColorEmoji, 'Segoe UI Symbol', 'Android Emoji', EmojiSymbols; font-size: 16px;">
omero.ldap.group_filter=(|(hyGroupMemberships=uid=grp-A91900-lmu-cust,ou=alma_workgroups,ou=groups,o=hy)(hyGroupOwnerships=uid=grp-A91900-lmu-cust,ou=alma_workgroups,ou=groups,o=hy))</div>
<div>But the result is "no group found for user" in the log.</div>
</div>
<div><br>
</div>
<div>Is this even possible when the groups and users are in different subtrees?</div>
<div>
<div>omero.ldap.base=dc=helsinki,dc=fi</div>
<div>To find the groups with ldapsearch I have to set "<span style="font-family: Calibri, Arial, Helvetica, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', NotoColorEmoji, 'Segoe UI Symbol', 'Android Emoji', EmojiSymbols; font-size: 16px;">-b ou=alma_workgroups,ou=groups,o=hy</span>".</div>
<div><br>
</div>
<div>Using :filtered_attribute:hyGroupMemberships would only work for group members. Group leaders don't have that attribute set, they would need :filtered_attribute:hyGroupOwnerships. Is it possible to use something like </div>
<div>:filtered_attribute:(|(hyGroupMemberships,hyGroupOwnerships))?</div>
<br>
</div>
<br>
<p></p>
<p>Thanks in advance for any suggestions!</p>
<p><br>
</p>
<p>Best regards,</p>
<p>Harri</p>
<p><br>
</p>
<div id="Signature">
<div id="divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<p>---</p>
<p>Harri Jäälinoja</p>
<p>Light Microscopy Unit</p>
<p>Institute of Biotechnology</p>
<p>University of Helsinki</p>
</div>
</div>
</div>
</body>
</html>