How do I map active directory group membership (ldap authorization) to og groups in open atrium?

Question

I can successfully bind to the ldap server, and I have set up authentication successfully - ldap users can log in to my open atrium site. However, the authorization mappings for the groups aren't coming through.

I have this as a mapping under: admin/config/people/ldap/authorization/edit/og_group

CN=Human Resources,OU=Groups,OU=Domain Users,OU=Domain Controllers,DC=domainname,DC=com|node:100:6

Where "100" is the node id for the open atrium space (og group), and "6" is a custom group admin role with a set of permissions defined in: admin/config/group/roles/node/oa_space

However, when I log in with a user that is confirmed to have this "memberof" attribute in active directory, the user does not have the corresponding access to the organic group.

I have tried both "Convert full dn to value of first attribute before mapping" checked and unchecked with the same results.

The mapping is shown to be enabled here: admin/config/people/ldap/authorization

I'm finding the documentation a little lax here. Am I mapping the correct og role id? Does the og role id translate to the role id in admin/config/group/roles/node/oa_space? Is this set somewhere else? Where? Is there anything else I have to do to bring these mappings over?

Answer 1

I had this same problem recently whereby this was originally working:

GroupA|IT:member
GroupA_Admins|IT:member
GroupA_Admins|IT:administrator member

During this course of development this stopped working and on alternate logins a user in that LDAP group would either be a member of the organic group, or not (but never an administrator of that group).

I eventually worked out that it had stopped working because I had since overridden the permissions of the space, which meant that the OG role ids were different, even though they had the same name.

Therefore:

GroupA|IT:member
GroupA_Admins|IT:member
GroupA_Admins|IT:administrator member

was being automatically converted to

GroupA|IT:member (raw: node:3:5)
GroupA_Admins|IT:member (raw: node:3:5)
GroupA_Admins|IT:administrator member (raw: node:3:6)

when actually since it was no longer using the default roles, it should have been using 8 and 9 instead of 6 and 7.

Rewriting the mapping to explicitly use the ids for the overriding roles rather than their names worked:

GroupA|node:3:8
GroupA_Admins|node:3:8
GroupA_Admins|node:3:9

I know this is a very old post to reply to, but I was struggling with this yesterday so hope it helps someone else in future.