[ome-users] LDAP group mapping question

[Mark Carroll]

Dear Harri,

> I've set up LDAP authentication, the basic case where all users are
> added to one default group works ok. This is probably enough for our
> unit. However, there is another use case where it would be necessary to
> divide users according to research groups. Previously we used a plugin,
> but I'd like to check with you first if it's possible to get the desired
> result with the improved LDAP support.
> But then to the more complicated use case. If I set
> omero.ldap.new_user_group:attribute:hyGroupMemberships,
> a whole bunch of groups will be created, but only one is relevant (the
> one indicating the research group), so somehow I should use
> :filtered_attribute:. So far I have tried using the same filter as for
> users:
> omero.ldap.group_filter=(|(hyGroupMemberships=uid=grp-A91900-lmu-cust,ou=alma_workgroups,ou=groups,o=hy)(hyGroupOwnerships=uid=grp-A91900-lmu-cust,ou=alma_workgroups,ou=groups,o=hy))
> But the result is "no group found for user" in the log.
>
> Is this even possible when the groups and users are in different subtrees?
> omero.ldap.base=dc=helsinki,dc=fi
> To find the groups with ldapsearch I have to set "-b
> ou=alma_workgroups,ou=groups,o=hy".

Thank you for describing your question / problem so clearly. I am afraid
that I don't know much about LDAP and those who do are either on leave
or extremely busy today, but if it takes us a day or two to properly
answer this, don't fear: I'll keep your question on the radar. In the
meantime, I offer my apologies for our brief lack of available LDAP
expertise; do let us know if you make any further progress with it in
the meantime. It's great that you are helping us to push at the question
of what all can be done with OMERO as it's very useful to have
real-world use cases to consider in our planning and testing.

Cheers,

Mark

The University of Dundee is a registered Scottish Charity, No: SC015096