Assume you have a populated directory and some groups that should be mapped into eXo Platform.
To be clear about the LDAP "group", it should be the "groupOfNames" objectClass in OpenLDAP or "group" objectClass in MSAD. In OpenLDAP (default core.schema), the groupOfNames must have the member attribute.
Let's see the
Under the context DN (
ou=Roles,o=acme,dc=example,dc=com), there are several groups:
dn: cn=admins,ou=Roles,o=acme,dc=example,dc=com dn: cn=employees,ou=Roles,o=acme,dc=example,dc=com
cn=admins group has a member:
dn: cn=admins,ou=Roles,o=acme,dc=example,dc=com objectClass: top objectClass: groupOfNames cn: admins member: uid=admin,ou=People,o=acme,dc=example,dc=com
Once the group mapping is done, there should be a group like /acme/roles/admin in eXo Platform. The group name is like a translation of the dn, with the suffix (dc=example,dc=com) is eliminated. The admin user should be a member of this group.
From the concepts, there are two things about group mapping:
The parent group (that is, /acme/roles) must be created (in eXo Platform) manually.
In eXo Platform, a membership is expressed like this: manager:/acme/roles/admin in which manager is a membership type that is required to form a membership. Because the membership type is not an LDAP concept, for the creation of membership, you need to provide a default membership type in configuration.
In this tutorial, you will write your own group mapping configuration but you should refer to sample files
portal.war!/WEB-INF/conf/organization/picketlink-idm/examples - see the files which have "acme" in name).
Notice the configuration involves 2 files:
Create your group type.
idm-configuration.xml file, the Platform parent group needs to be matched with your group type and be declared
in ignoreMappedMembershipTypeGroupList field:
<collection type="java.util.ArrayList" item-type="java.lang.String">
As explained above, a default membership type needs to be configured. Some values you can use are member, manager, editor (those are pre-defined types in eXo Platform but can be re-configured or changed via UI).
picketlink-idm-ldap-config.xml, the group type is declared under the identity store PortalLDAPStore.
First, write a few lines for the schema of the group type, you will fill up attributes and options later:
The group type needs to be referenced by the PortalRepository repository:
Add the attributes mapping.
The Platform group "id" is groupName. Its mapping is definitive and is configured by options, not attributes. The other attributes are label and description, both are not mandatory. You can map them to cn and description LDAP attributes.
You need to configure the LDAP attribute that matches to group "id" (groupName in Platform). Traditionally, it is cn:
The ctxDNs (context DNs) accepts multiple values and is the list of the base DNs under which the groups can be found.
By default, all the groups under the base will be searched and mapped. You are able to add filter, for example to exclude the "theduke" group:
In OpenLDAP or MSAD default schemas, the member attribute is used to list the dn of the members. However, your schema may use another attribute, so it should be configurable (if this option is absent, the group will be mapped without members):
Along with it, the
isParentMembershipAttributeDN option must be set to true:
As explained above, the parent group ("/acme/roles" in this example) needs to be created manually. You can create it after deploying your custom extension and start the server.
When the LDAP users and groups are mapped into eXo Platform, their data (for example, user profile, personal document, calendar) need to be created as if they were Platform users and groups. See Synchronization for how-to.