I can successfully bind to the ldap server, and I have set up authentication successfully - ldap users can log in to my open atrium site. However, the authorization mappings for the groups aren't coming through.

I have this as a mapping under: admin/config/people/ldap/authorization/edit/og_group

CN=Human Resources,OU=Groups,OU=Domain Users,OU=Domain Controllers,DC=domainname,DC=com|node:100:6

Where "100" is the node id for the open atrium space (og group), and "6" is a custom group admin role with a set of permissions defined in: admin/config/group/roles/node/oa_space

However, when I log in with a user that is confirmed to have this "memberof" attribute in active directory, the user does not have the corresponding access to the organic group.

I have tried both "Convert full dn to value of first attribute before mapping" checked and unchecked with the same results.

The mapping is shown to be enabled here: admin/config/people/ldap/authorization

I'm finding the documentation a little lax here. Am I mapping the correct og role id? Does the og role id translate to the role id in admin/config/group/roles/node/oa_space? Is this set somewhere else? Where? Is there anything else I have to do to bring these mappings over?

1 Answer 1


I had this same problem recently whereby this was originally working:

GroupA_Admins|IT:administrator member

During this course of development this stopped working and on alternate logins a user in that LDAP group would either be a member of the organic group, or not (but never an administrator of that group).

I eventually worked out that it had stopped working because I had since overridden the permissions of the space, which meant that the OG role ids were different, even though they had the same name.


GroupA_Admins|IT:administrator member

was being automatically converted to

GroupA|IT:member (raw: node:3:5)
GroupA_Admins|IT:member (raw: node:3:5)
GroupA_Admins|IT:administrator member (raw: node:3:6)

when actually since it was no longer using the default roles, it should have been using 8 and 9 instead of 6 and 7.

Rewriting the mapping to explicitly use the ids for the overriding roles rather than their names worked:


I know this is a very old post to reply to, but I was struggling with this yesterday so hope it helps someone else in future.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.