7 - Mapping multiple LDAP groups to single Drupal roles using Boolean operators

Question

I'm attempting to set up fairly complex permissions in D7 based on LDAP group membership, and it would help greatly if there were a way to use Boolean operators to perform the role mapping.

Some context:

1. There are multiple, similar departments: each has a pool of employees, and each has a manager.
2. LDAP groups map to departments as well as roles. The manager of the Finance department belongs to two groups: one that designates the group Finance_dept, another that designates the group Managers.
3. Managers should have R/W access to parts of the site that correspond only to their respective departments; employees should only have R access.

What I've tried (and ruled out):

I have the LDAP module configured to provision Drupal roles based on LDAP group membership--that piece works well for one-to-one mappings; e.g.:

• Finance_dept|finance
• Managers|managers

I've tried various iterations of LDAP search filters, to no effect:

• Finance_dept & Managers|finance_managers
• (&(Finance_dept)(Managers))|finance_managers

Has anyone gotten this to work?

Answer 1

Until I can find (or someone else posts) a better way to do this, my interim solution is:

1. Set up LDAP group -> Drupal role provisioning as normal.
2. Use the Rules module to assign/revoke another role programmatically on events User has logged in, and Before saving a user account.

Example (referring to my question above):

LDAP Provisioning:

• Finance_dept|finance

• Managers|managers

Create roles manually:

• financemanagers

Rules:

Finance_dept + Managers = FinanceManagers

• Events: User has logged in, Before saving a user account
• Elements: User has role(s): finance, managers
• Actions: Add user role: financemanagers

Removed from either Finance or Managers

• Events: User has logged in, Before saving a user account
• Elements:
  • NOT User has role(s): finance
  • OR
  • NOT User has role(s): managers
• Actions: Remove user role: financemanagers

Works for now, but it won't scale well beyond a handful of role combinations.