K1000 LDAP - Importing Multiple Security Groups
Hi all, not sure if I'm barking up the wrong tree or approaching this the wrong way with my kbox, but here's what I'm looking to do
We have around 1200 AD users and probably around 100 Security Groups actively used. We take advantage of these for server folder security mostly. An average AD user can be a member of anywhere between 2-20 security groups, depending on their role.
We have around 1200 AD users and probably around 100 Security Groups actively used. We take advantage of these for server folder security mostly. An average AD user can be a member of anywhere between 2-20 security groups, depending on their role.
I'm looking to import all of these security groups as individual LDAP labels in my kbox, so that I can use the User Console to publish software that I only want available to certain users in certain roles. For example, I only want MS Project available to users who are a member of a "Project MGMT" security group. We have 10-12 "Project MGMT" security groups for each agency in my network.
I'm looking for a way of capturing all of the security groups as individual labels during the User Import, otherwise it will take me forever and a day to create all the labels myself and do many many smaller imports with narrower searches. Currently, if I import my entire "User Groups" OU, and I have a user that is a member of, say, 4 different groups, the label is getting imported like this:
"ldap_Domain Users, Domain Admins, Desktop Lite, Local Admins"
rather than this
"ldap_Domain Users"
"ldap_Domain Admins"
"ldap_Desktop Lite"
"ldap_Local Admins"
Does anyone have experience with something like this? I'm wondering if there is a better way to approach this, or maybe some more intelligent logic I can build into my query.
Thanks!
5 Comments
[ + ] Show comments
Answers (1)
Please log in to answer
Posted by:
Chris.Burgess
10 years ago
So it turns out the instructions were slightly... wrong. But only SLIGHTLY! There is a variable in the query which is wrong, and once changed it works fine. Here is my LDAP label for the "Work around" method. Note I've blanked out my server address and stuff.
I set my search DN to the base level of my domain because I have many, many levels and I need it to search all of them. Then I set the filter as shown. The part that was wrong is this first variable. It HAS to say KBOX_USER_NAME If you hit the TEST button, it comes back with 0, but it actually works!! Just incase you are curious, the UserAccountControl part says to ignore any disabled accounts (we don't delete users, just disable and move them).
Also note, that the KB article says to put something like "LDAP_" as your label prefix. Well we had already imported our labels and used the prefix "user_" so that is why mine is set that way.
I hope this helps!!
http://www.kace.com/support/resources/kb/solutiondetail?sol=125815 - Chris.Burgess 10 years ago