Versions Compared

Version Old Version 7 New Version 8
Changes made by

Hanan Kenan

Amit Munwes

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Scenario A - Define Roles as attributes on the user directory entry

With this method, the LDAP administrator defines an attribute, for example DPOD_role attribute, at the user directory entry level that contains the role name of that user. 
Multiple roles are assigned using several instances of the attribute in the user entry. 
The attribute must be defined in the user class LDAP schema.

Example 1:

An administrator user named "john" (CN=john) has the attribute "DPOD_role=OpDashAdminRole".

Scenario B - Define Roles as attributes on the group directory entry

With this method, the LDAP administrator defines an attribute at the group directory entry level that contains the role name of that group. The roles of a user are fetched by searching for all groups of a user and accumulating the values of the attribute from each group entry. 
Multiple roles are assigned by adding the user to several groups that have that attribute defined. The attribute should be defined in the group class LDAP schema.

Example 2: (group CN equals to role name):

An administrator user named "john" (CN=john) belongs to a group named "OpDashAdminRole" (CN=OpDashAdminRole)

Example 3 (custom attribute):

An administrator user named "john" (CN=john) belongs to a group named "DPAdmins" that has the attribute "DPOD_role=OpDashAdminRole".


Step 1- choose your preferred scenario:

Scenario A - an attribute at the user directory entry

When your installation scenario matches Scenario A in the Concepts Section, perform the following steps:

  1. If necessary, add an attribute to the user class LDAP schema (e.g. DPOD_role attribute).
  2. For each user that should use DPOD's Console, add the attribute with one of the built-in role names:
    1. OpDashAdminRole
    2. OpDashPowerUserRole 
    3. OpDashOperatorRole
    4. OpDashInvestigatorRole

Scenario B - an attribute at the group directory entry

When your installation scenario matches Scenario B in the Concepts Section, perform the following steps:

...

Note

If the groups CN is the same as the built-in role names, no additional attribute is required.

 Step 2 - Configure Authentication 

  1. Follow Configure LDAP Authentication

 Step 3 - Configure Applicative Authorizations

...