0

In our LDAP we have user attribute memberOf witch indicates what groups a user is a member of. The value of memberOf attribute represented by full group DN. Here is the example:

memberOf = CN=PROJ_Admins_GeoNetwork,OU=PROJ,OU=Groups,OU=ORG,DC=org-it,DC=com

I want to set up GeoNetwork to automatically generate groups for user based on memberOf value. Here is section for that in config-security-overrides.properties:

# Map user information to LDAP attributes and default values
ldapUserContextMapper.mapping[name]=givenName,
ldapUserContextMapper.mapping[surname]=sn,
ldapUserContextMapper.mapping[mail]=mail,[email protected]
...↓
ldapUserContextMapper.mapping[privilege]=privileges,sample
ldapUserContextMapper.mapping[profile]=profile,RegisteredUser

I need to set: ldapUserContextMapper.mapping[privilege]={user's attribute with groups from LDAP},{default group name}

So I ended up with: ldapUserContextMapper.mapping[privilege]=memberOf,default_group

But the problem is that I don't want the entire value of memberOf to be the name of created GN groups. I just need a part after CN= and before ,OU=PROJ...:

memberOf = CN=PROJ_Admins_GeoNetwork,OU=PROJ,OU=Groups,OU=ORG,DC=org-it,DC=com

My question is: can I use regular expression or LDAP queries in the config-security-overrides.properties and what should it be?

Improve this question

1 Answer 1

Reset to default
0

Check the documentation about LDAP privileges configuration.

You will need to enable the LDAPUserDetailsContextMapperWithPattern in WEB-INF/config-security/config-security-ldap.xml commenting out the default ldapUserContextMapper. Then in WEB-INF/config-security/config-security.properties define ldap.privilege.pattern, ldap.privilege.pattern.idx.group and ldap.privilege.pattern.idx.profil:

ldap.privilege.pattern=CN=([^_]+_([^_]+)_[^_,]+).*
ldap.privilege.pattern.idx.group=1
ldap.privilege.pattern.idx.profil=2

The first capturing group is capturing the full group name, for example for CN=PROJ_Admins_GeoNetwork,OU=PROJ,OU=Groups,OU=ORG,DC=org-it,DC=com it's capturing PROJ_Admins_GeoNetwork. The second capturing group is capturing the profile, in this example Admins. To make GeoNetwork understand this group it should be one of Administrator, UserAdmin, Reviewer, Editor or RegisteredUser instead of Admins

Improve this answer
2
  • Thank you for the regex and describing steps! Is there a way to skip not valid role names like Admins and set default RegisteredUser profile defined after comma in config-security-overrides.properties : ldapUserContextMapper.mapping[profile]=memberOf,RegisteredUser ? My user have multiple groups, some of them I configured to contain Administrator, but some still contains other words. When I logging GN show me that error: ``` MESSAGE: java.lang.IllegalArgumentException: No enum constant org.fao.geonet.domain.Profile.Admins ```
    – dmtflmnv
    Commented Oct 23, 2022 at 17:35
  • Is there a way to extract group from LDAP user's property with regex and ignore profile (set default one)?
    – dmtflmnv
    Commented Oct 26, 2022 at 3:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.