Older version

Add configuration to filter results in MFAAdmin based on logged-in user

This document is written for PhenixID Server.

The reader should have some basic knowledge about PhenixID Server.

This document describes how to add configuration to filter results in MFAAdmin based on attribute value from logged-in user.

Overview

During setup of MFAAdmin, an organizational unit is pointed out. All MFAAdmin users will by default have access to manage all users in the ou.

This document will describe how to add configuration to filter the results in MFAAdmin. By doing this, the logged-in user will only be able to manage the users in his/her ou.

During authentication, the attribute will be added to the session. During MFAAdmin search operations, the attribute value from the session will be fetched and added to the search filter.

Please make sure to have a backup copy of the configuration before adding the new settings.

Prerequisites

MFAAdmin configured.
MFA Admin users in different OUs. (This can be changed to suit your environment)
OU value stored in adminDescription attribute of user object. (This can be changed to suit your environment)

(In the example below, the MFAAdmin base DN is MFAAdmin_Delegate_Demo. There are two ous below, A and B. Each ou has one MFA administrator, A_Admin and B_Admin. They should only be able to manage users within their own ou.)

Modify authentication pipe

1. Log in to the configuration UI, go to the "Advanced" tab and open the Modules section.

2. Find the mfaadmin module.

3. Find the auth_redirect_url parameter.

4. Copy the authentication alias (the value after /authenticate/

5. Open the HTTP - Authentication section

6. Search for the alias value fetched in previous step

7. Copy the pipeID value

8. Open the Pipes section and search for the pipeID copied in previous step

9. Append this value to the valve_refs parameter:

,Valve_SessionLoad,Valve_SessionAddOU,Valve_SessionSave

10. Click Stage Changes and Commit Changes

11. Click on the pen to the right of Pipe Valves

12. Add these valves:

{
				"name": "SessionLoadValve",
				"id":"Valve_SessionLoad",
				"config": {
					"id": "{{request.session_id}}"
				}
			},
			{
				"name": "SessionPropertyAddValve",
				"id":"Valve_SessionAddOU",
				"config": {
					"name": "OU",
					"value": "{{item.adminDescription}}"
				}
			},
			{
				"name": "SessionPersistValve",
				"id":"Valve_SessionSave",
				"config": {
					
				}
			}

13. Click Stage changes

14. Click Commit changes

15. Open Pipe Valves. Verify that the new valves have been added.