I'm attempting to set up fairly complex permissions in D7 based on LDAP group membership, and it would help greatly if there were a way to use Boolean operators to perform the role mapping.
- There are multiple, similar departments: each has a pool of employees, and each has a manager.
- LDAP groups map to departments as well as roles. The manager of the Finance department belongs to two groups: one that designates the group Finance_dept, another that designates the group Managers.
- Managers should have R/W access to parts of the site that correspond only to their respective departments; employees should only have R access.
What I've tried (and ruled out):
I have the LDAP module configured to provision Drupal roles based on LDAP group membership--that piece works well for one-to-one mappings; e.g.:
I've tried various iterations of LDAP search filters, to no effect:
- Finance_dept & Managers|finance_managers
Has anyone gotten this to work?