LDAP role and rights mapping

A mapping between the LDAP user and the internal roles used by the solution hub service is required. The basic idea is that the membership in the LDAP groups is used as an indicator for the solution hub rights.

First of all, one has to specify the LDAP attribute that contains the group membership information. This is done by anonymous.group.

The second step is the configuration of the group mapping. The group mapping is configured in an XML file that can be found in the config/security_settings.xml of the installation directory.

The basic configuration is defined in the section <authTypeMapping type="ldap">. An example can be seen in the following code fragment:

<!--
 | #################################################################################################################
 | # ldapGroups
 | #################################################################################################################
 |
 | Contains a list of groups that are mapped between ldap groups and internal solution hub groups. This mapping
 | allows the flexible configuration between ldap and solution hub. For every group a set of roles has to be given
 | that define the roles that are associated with this group
 -->

<authTypeMapping type="ldap">
 
 <!--
	 | #################################################################################################################
	 | # Definition of a mapping between ldap group and Solution Hub rights
	 | #################################################################################################################
	 |
	 | ldapName: the name of the ldap group
	 | description: a human-readable text that describes the idea of this group
	 | hasRoles: contains a comma separated list of all roles that are assigned to this ldap group
	 |           If * is given, all configured roles are assigned
	 | isMemberOf: contains a comma separated list of all base groups that are assigned to this ldap group
	 |           If * is given, all configured roles are assigned
	 -->

 <group name="Admin" description="A full administration user for solution hub" >
  <hasRoles>*</hasRoles>
  <isMemberOf></isMemberOf>
 </group>
 
 <group name="ReadOnly" description="A user that is intended for monitoring only" >
  <hasRoles></hasRoles>
  <isMemberOf>ReadAccess</isMemberOf>
 </group>

</authTypeMapping>

Additionally, the definition of the base groups can be changed in the configuration file. An example can be seen in the following code fragment:

<!--
 | #################################################################################################################
 | # baseGroups
 | #################################################################################################################
 |
 | Definition of different groups that subsume always a set of rules
 -->
<baseGroups>

 <!--
	 | #################################################################################################################
	 | # Definition of one solution hub group
	 | #################################################################################################################
	 |
	 | name: the name of solution hub group
	 | description: a human-readable text that describes the idea of this group
	 | hasRoles: contains a comma separated list of all roles that are assigned to this ldap group
	 | isMemberOf: contains a comma separated list of all base groups that are assigned to this ldap group
	 -->

 <group name="DistributedManagement.Admin">
  <isMemberOf>ReadAccess,WriteAccess</isMemberOf>
  <hasRoles></hasRoles>
 </group>

 <group name="ReadAccess" >
  <hasRoles>
   Deployment.Read,Artifact.Read,SystemEvents.View,BusinessEvent.Read  
  </hasRoles>
 </group>

 <group name="WriteAccess" >
  <hasRoles>
   SystemEvents.Delete,BusinessEvent.Modify,BusinessEvent.Delete,Artifact.Modify,Artifact.Delete,Deployment.Modify,Deployment.Delete,Deployment.Sync 
  </hasRoles>
 </group>
 
 <group name="Licensing" >
  <hasRoles>
   Licensing.View,Licensing.Admin
  </hasRoles>
 </group>

</baseGroups>

info

This file is reloaded automatically if it is changed manually.