# LDAP Extras
# Preamble
The EE server supports the LDAP protocol that allows you to configure an external LDAP service for authentication. You may configure certain extras, e.g. to restrict access to members of a certain group. This guide will explain how to do that.
TIP
This feature is only available in the Enterprise Edition.
# Restrict to members of certain LDAP group
You can configure the server to allow only members of a certain group to access and use Psono.
LDAP : [
{
...
'LDAP_REQUIRED_GROUP': ['CN=g1,OU=Groups,OU=example.com,DC=example,DC=com']
...
},
]
Restart the server afterward.
TIP
The filtering is done by Python and as such is case sensitive!
# Restrict to users with a certain attribute
You can configure the server to allow only LDAP users with a certain attribute to access and use Psono. You can either
force the presence of the attribute (use *
to require only the presence) or require it to be set to a certain value.
LDAP : [
{
...
'LDAP_REQUIRED_ATTRIBUTE': [['displayName', '*']]
...
},
]
Restart the server afterward.
TIP
The filtering is done by Python and as such is case sensitive!
# Filter users with custom LDAP query
If the standard options are not enough to filter users, you can also provide some custom LDAP filtering on top. So e.g.
to filter users by the absence of a certain attribute (here nsaccountlock
) you could do the following:
LDAP : [
{
...
'LDAP_CUSTOM_USER_FILTER'='(!(nsaccountlock=TRUE))'
...
},
]
# Filter groups with custom LDAP query
If the standard options are not enough to filter groups, you can also provide some custom LDAP filtering on top. So e.g.
to filter groups by the absence of a certain attribute (here nsaccountlock
) you could do the following:
LDAP : [
{
...
'LDAP_CUSTOM_GROUP_FILTER'='(!(nsaccountlock=TRUE))'
...
},
]
Restart the server afterward.
# Automatically create Psono groups
You may want to automatically create a Psono Group for all created / imported LDAP groups and a corresponding mapping.
LDAP : [
{
...
'AUTOPROVISION_PSONO_GROUP': True
...
},
]
Restart the server afterward.
# Set forced membership for created groups
If you automatically create Psono groups for every LDAP group with the AUTOPROVISION_PSONO_GROUP
flag, you can set
this flag here so that every new group has "forced membership" checked.
LDAP : [
{
...
'FORCE_MEMBERSHIP_OF_AUTOPROVISIONED_GROUPS': True
...
},
]
Restart the server afterward.
# Automatically create shared folder for group
You may want to automatically create a new folder and share it automatically with any new created / imported LDAP group. Requires AUTOPROVISION_PSONO_GROUP
to be set to true to have any effect.
LDAP : [
{
...
'AUTOPROVISION_PSONO_FOLDER': True
...
},
]
Restart the server afterward.
# Prevent paging
Some servers might not allow LDAP paging. You can disable this
LDAP : [
{
...
'PAGING_ENABLED': False
...
},
]
Restart the server afterward.
# Search users by LDAP attributes
You may want to allow users to search others e.g. by their first name or lastname which may not part of the created "username" attribute.
In the example below we assume that you have two ldapAttributes e.g. "firstName" and "lastName" containing the first and lastname of a user.
With the config below these attributes would be imported into Psono, and allow people to search for those attributes.
This works only in combination with ALLOW_USER_SEARCH_BY_USERNAME_PARTIAL
being set to True.
ALLOW_USER_SEARCH_BY_USERNAME_PARTIAL: True
LDAP : [
{
...
'LDAP_ATTR_DISPLAY_NAME': ['firstName', 'lastName']
...
},
]
Restart the server afterward. User's may have to logout and login to trigger the LDAP sync and for the client to load these settings.