How to limit login to specific group membership in LDAP search
This document describes how to limit the login to one or more specific groups in the LDAP directory, so only accounts that are members of this/these group(s) get pass
The reader of this document should have some basic knowledge about PhenixID Server.
System requirements
- PhenixID Server installed.
- Group(s) in LDAP directory
Overview
The examples below will show how the LDAP search can be configured to only allow access to those accounts that are members of one or more specific groups in LDAP.
We will make changes to the configuration file phenix-store.json, so please make sure to have a backup of this file.
Example of LDAP search configuration
Login to the configuration portal and locate the scenario that you want to modify.
Now go to "Execution Flow" and find the LDAPSearchValve.
Should look similar to this, when using default values:
Now we add the group membership part to the search, like this example for one group:
(&(sAMAccountName={{request.User-Name}})(memberOf=CN=Group1,OU=Training,DC=company,DC=local))Example of search for two groups:
(&(sAMAccountName={{request.User-Name}})(|(memberOf=CN=Group1,OU=Training,DC=company,DC=local)(memberOf=CN=Group2,OU=Training,DC=company,DC=local)))In the example above login will be accepted if user logging in, is member of either group.
Configuration should now look similar to this:
