Filter users based on security groups

Is it possible to filter the incoming users based on a security group? We have an Active Directory structure where not all users in Active Directory will have a Livelink account. However there is no distinguishing attribute that sets these users apart. I have been playing with the directory services module for sometime now and so far the best idea that we have come up with for importing users has been to set an attribute that we currently don't use to "livelink" and then filter users based on that.Another option that has been brought up is adding all livelink users to one security group in Active Directory and then only import the users in that security group into OpenText. Is this possible?ThanksJohn

Find more posts tagged with

Comments

Appu_Nair

Not sure if this will make sense or not but in many orgs they want to create a big group of all users of the company so that it becomes easy to provide a company wide perm setting rather than PA.So we ask the AD admin to create a group calledLivelink-ALLand populate in it from AD Livelink-India-usersLivelink UK-users etc.These are functional groups identifying some method to the madnessThen if we create a filter for group for Livelink-ALL and use the membership attribute the ad sync will create all the users in Livelink-ALL.It will create a group called Livelink-India-users and add the users to it as well.so a user in Livelink-India would have his "department' to Livelink-All and part of Livelink_india as well.Otherwise you will end up creating a lot of synchronization accounts and becomes very complicated.when you put Livelink-ALL in a object at EWS it is akin to giving every person who came thru AD access to the object.It also adheres to the rule that you should not create more than 1000 users in a group ...I have seen in some places ad has a distinguihing attribute as well.

John_Lemko

Thanks for the advice Appu. It's promising that you think it will work but I can't figure out what filter you would have in the user search filter to allow only users in that one security group imported right now we have:(&(objectclass=user)(businessCategory=livelink))I understand we can filter only the 1 security group "Livelink-ALL" in your example but it seems to me that is a Group Search filter and it will not filter out any of the users. So a user will be brought in even if he is not a member of that security group because they are not filtered out in the user search filter.Thanks

Appu_Nair

Here's how I have it setup in our present project and i changed the OU info but you should probably understand the query.I do not know AD very well but just to get by.My user filter box will be like this(&(objectClass=person)(objectClass=user)(memberOf=CN=Livelink_INTERNAL,OU=LiveLink Test Groups,DC=domain,DC=company,DC=com))In English find users who are memebers of that group and put them in this livelink group called Livelink_INTERNAL.We manually create that group in livelink.My group filter is this (&(objectClass=group)(cn=LIVELINK_*))Find all groups and use the wildcard for any group starting withLivelink.When the sync runs all group memeberships will look the same as the AD memberships only thing is that every user will have the department Livelink_INTERNALFor this to work one has to put Synchronize Groups and in AD usemember as the attribute for Group Member.By default OT prefills it with the attribute for LDAP and you may have to change it.As I said I choose the easy understandable queries but to a really good AD mind almost anything you can craft with AD it may be possible to acheive.

Chris_Wagg

Message from Chris Wagg <cwagg@opentext.com> via eLink

eLink

This is actually quite a common way of using search filters when synching users into Livelink. The filter that you gave as an example is the right format. If you wanted to filter on a group membership, you could just do something like this:

(&(objectclass=user)(memberOf=<distinguished name of your group>))

Hope this helps.

Chris

From: eLink Discussion: Content Server Directory Services Discussion [mailto:directoryservices@elinkkc.opentext.com]
Sent: Monday, February 28, 2011 6:26 PM
To: eLink Recipient
Subject: Thanks for the advice Appu.

Thanks for the advice Appu.		Posted by lemko@strathcona.ab.ca (Lemko, John) on 2011/02/28 18:22
In reply to: I would think your idea would work		Posted by anair@alitek.com (Nair, Appu) on 2011/02/28 17:33

Thanks for the advice Appu.

It's promising that you think it will work but I can't figure out what filter you would have in the user search filter to allow only users in that one security group imported right now we have:
(&(objectclass=user)(businessCategory=livelink))

I understand we can filter only the 1 security group "Livelink-ALL" in your example but it seems to me that is a Group Search filter and it will not filter out any of the users. So a user will be brought in even if he is not a member of that security group because they are not filtered out in the user search filter.

Thanks

[To reply to this thread, use your normal E-mail reply function.]
Topic:	Filter users based on security groups
Discussion:	Content Server Directory Services Discussion
Livelink Server:	knowledge-wlweb01

To Unsubscribe from this Discussion, send an e-mail to unsubscribe.directoryservices@elinkkc.opentext.com.

John_Lemko

Thanks a lot for the help. Filtering on memberOf makes sense to me and I think it will work for us.Thanks again.John

Mohammed_Abushmais

For some admin purpose, the AD people are not ready to remove a user from the group.. is there a way where we can synch all the users from a group but one.