LDAP Group Import Integration Not Work

[Gautama Himawan，修改在15 年前。]

Hi,

I have some problem when using LDAP and Liferay integration.

I create some user and user group in LDAP.
Liferay has succesfully import the user entry from LDAP but not the user group.
So only user list exist in the "Users" tab in "Enterprise Admin",
but the user group does not exist in "User Groups" tab in "Enterprise Admin".
I already follow the tutorial and example in Wiki, also search in forum but there are no answer for my problem.

Can anyone help me to solve my problem, because I'm not an LDAP and Java expert.


Here is my data:

- Liferay 5.1.1
- Apache DS 1.0.2
- OS Linux Ubuntu 7
- LDAP client JXplorer 3.2

==========================================================================

- LDAP setting in Liferay (also in attachment picture):

* Enabled (checked)

Default Values tab
* Apache Directory Server (checked)

Connection tab
* Base Provider URL : ldap://localhost:10389
* Base DN : dc=mtech,dc=com
* Principal : uid=admin,ou=system
* Credentials : *****

Users tab
* Authentication Search Filter : (mail=@email_address@)
* Import Search Filter : (objectClass=inetOrgPerson)

User Mapping
* Screen Name : cn
* Password : userPassword
* Email Address : mail
* Full Name :
* First Name : givenName
* Last Name : sn
* Job Title : title
* Group : groupMembership

Groups tab
* Import Search Filter : (objectClass=groupOfUniqueNames)

Group Mapping
* Group Name : cn
* Description : description
* User : uniqueMember

Import / Export tab

* Import Enabled (checked)
* Import on Startup Enabled (checked)
* Import Interval (5 Minutes)
* Export Enabled (checked)
* Users DN : ou=users,dc=mtech,dc=com
* User Default Object Classes : top,person,inetOrgPerson,organizationalPerson
* Groups DN : ou=groups,dc=mtech,dc=com

Password Policy tab
* Use LDAP Password Policy (checked)

==================================================================

- LDAP data:
* Group: manager, employee
* User: tom (manager), clara (user), john (user), steven (user)

* Group LDIF:

    dn: ou=groups,dc=mtech,dc=com
    objectClass: organizationalUnit
    objectClass: top
    ou: groups
    
    dn: cn=employee,ou=groups,dc=mtech,dc=com
    objectClass: groupOfUniqueNames
    objectClass: top
    cn: employee
    uniquemember: 50000

    dn: cn=manager,ou=groups,dc=mtech,dc=com
    objectClass: groupOfUniqueNames
    objectClass: top
    cn: manager
    uniquemember: 50001

* User LDIF:

    dn: ou=users,dc=mtech,dc=com
    objectClass: organizationalUnit
    objectClass: top
    ou: users
    
    dn: cn=tom,ou=users,dc=mtech,dc=com
    objectClass: organizationalPerson
    objectClass: person
    objectClass: inetOrgPerson
    objectClass: groupOfUniqueNames
    objectClass: top
    cn: tom
    givenname: Tom
    mail: [e-mail]
    sn: Tom
    uniquemember: 50001
    userpassword:: dGVzdA==
    
    dn: cn=clara,ou=users,dc=mtech,dc=com
    objectClass: person
    objectClass: inetOrgPerson
    objectClass: organizationalPerson
    objectClass: groupOfUniqueNames
    objectClass: top
    cn: clara
    givenname: Clara
    mail: [e-mail]
    sn: Clara
    uniquemember: 50000
    userpassword:: dGVzdA==
    
    dn: cn=steven,ou=users,dc=mtech,dc=com
    objectClass: organizationalPerson
    objectClass: person
    objectClass: inetOrgPerson
    objectClass: groupOfUniqueNames
    objectClass: top
    cn: steven
    givenname: Steven
    mail: [e-mail]
    sn: Steven
    uniquemember: 50000
    userpassword:: dGVzdA==
    
    dn: cn=john,ou=users,dc=mtech,dc=com
    objectClass: organizationalPerson
    objectClass: person
    objectClass: inetOrgPerson
    objectClass: groupOfUniqueNames
    objectClass: top
    cn: john
    givenname: John
    mail: [e-mail]
    sn: John
    uniquemember: 50000
    userpassword:: dGVzdA==

I really appreciate any answer that could solve my problem. Thanks.


Below is the attachment picture.

[Tobias Amon，修改在15 年前。]

Hi,

you can have either group import or user import.

The behaviour is as follows:

User: Import all users and groups where users are member of. e.g. if a user has the attribute "memberOf" with a valid group, the group will be imported as well and the user is assigned to it.

Group: Import all groups and members of the groups. e.g. if a group has one or more attributes "member" liferay will import all members as users.

[Gautama Himawan，修改在15 年前。]

I see.

But what objectClass to get the "memberOf" attribute?

The attribute that contain "member" string is "uniquemember" that get from groupOfUniqueNames objectClass.
Also it does not support multiple value in Apache DS.

[Tobias Amon，修改在15 年前。]

Hello,

you don't have to use "memberOf" attribute. Your configuration uses "uniqueMember" of class "groupOfUniqueMembers". That is OK... simply add the DN of a group there.

[Gautama Himawan，修改在15 年前。]

Hi,

Sorry, but I already add the group name in one of user (ex. user Clara), I put "employee" value into "uniquemember" attribute,
and still the group does not imported into Liferay.

Could you give me the example? Thanks.

[Tobias Amon，修改在15 年前。]

Hi,

I use Active Directory from MS, so I cannot give a real example as the implementations differ. But what you cannot use is just the name, maybe I pointed you to the wrong value in my last post.
You have to use the full name, e.g. OU=employee,OU=Internal_Users,DC=example,DC=com

[Gautama Himawan，修改在15 年前。]

Hi,

I already try as you suggest, but still does not work. Only user that import into Liferay, but the groups are not imported.

Could you give me the only one LDIF data of your user, and only one LDIF data of your group,
and also the LDAP configuration setting in your Liferay?
The dummy data is okay even if you are using MS Active Directory (as long as it works).
Because to see the LDIF data and Liferay configuration will be very helpful and can make better understanding for me.
Thank you.

[Gautama Himawan，修改在15 年前。]

Hi,

Finally I found the problem.
The problem is I still do not change the value in Liferay configuration for LDAP.

The value is still "groupMembership" in the entry Group at "Users" tab in "User Mapping" section.
The correct value should be "uniqueMember".
The value of "uniquemember" attribute in LDAP for each user is just like you say, it should be full DN.
So the LDIF user data (ex: for Clara) should be:

dn: cn=clara,ou=users,dc=mtech,dc=com
objectClass: person
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: groupOfUniqueNames
objectClass: top
cn: clara
givenname: Clara
mail: [e-mail]
sn: Clara
uniquemember: cn=employee,ou=groups,dc=mtech,dc=com
userpassword:: dGVzdA==

Thank you very much for your help, and hope this thread will be useful for other Liferay user.

Case closed


I have attach some picture to make easy to understand.

[Lucas A Blancher，修改在15 年前。]

Does anyone know if there is a way to get a round using the above method? My ldap schema only has member(for the group object) and it has memberOf(for the user). I have filled in the fields with the required information but it is not flowing through to my liferay installation, even though i have filled in the ldap fields with the fields that my schema uses.

Any one have any ideas?

Thanks,
Lucas

[Tobias Amon，修改在15 年前。]

Hi,

can you post some screenshots like Gautama did?

kind regards
Tobias

[Lucas A Blancher，修改在15 年前。]

Here are the requested screen shots.

Lucas

[Tobias Amon，修改在15 年前。]

Hi,

this looks almost OK. But you have a "cyclic" reference between your users and groups. Users seem to be member of groups. And groups seem to have members. This is not neccessary and maybe causes problems.

As my first post says: You can have either user import (and importing groups of that user), Or you can have group import (and import members of this group).

kind regards
Tobias

[Lucas A Blancher，修改在15 年前。]

That was it!, i cleared out the groups import information, and saved it, did a test import, and my groups showed up!

Thanks,
Lucas

[jean-marc tete，修改在13 年前。]

Lucas A Blancher:

That was it!, i cleared out the groups import information, and saved it, did a test import, and my groups showed up!

Thanks,
Lucas

Hi,

Excuse me but what field exactly did you clear?

Thank you.

[Robert L Zinn，修改在15 年前。]

Tobias Amon:

Hi,

you can have either group import or user import.

The behaviour is as follows:

User: Import all users and groups where users are member of. e.g. if a user has the attribute "memberOf" with a valid group, the group will be imported as well and the user is assigned to it.

Group: Import all groups and members of the groups. e.g. if a group has one or more attributes "member" liferay will import all members as users.

Can you clarify specifically how to import by users OR groups?
If importing by groups, do you leave the User import search filter blank and just qualify the Group's import search filter?
I assume you can do both by selecting import search filters for both. Can you clarify that you can import by Users only, Users within Groups only, or both ?

[nidhi singh，修改在15 年前。]

Hi Gautama,

You provided screen shorts, but by this we can only import or export data, we can't do both for importing and exporting.

we have to check only one field import or export.

If i need both data like i want to import LDAP data to lIferay and Liferay data to LDAp and there is mapping b/w group and user like your screen short

what should i do?

please tell me

Thanks