Skip to content

LDAP Synchronization

It's possible to synchronize DataWarehouse groups with external LDAP groups by enabling the FF_LDAP_GROUP_SYNC feature flag.

Groups configured to be synced by the LDAP integration are completely managed by it. This means that users manually added to these Django groups will be removed when the cron task runs.

Changes to the LDAP group are reflected when the cron updater runs. Newly added users to the LDAP group automatically get added to the Django group and removed users from the LDAP group are automatically removed from the Django group. This does not affect users added via extra_users.

Configuration

For LDAP queries to work it's necessary to setup a few configuration options using environment variables:

Name Required Description
FF_LDAP_GROUP_SYNC True Enable LDAP synchronization.
LDAP_SERVER_URL True Address of the LDAP server.
LDAP_BASE_SEARCH True Base DN for the search.
LDAP_MEMBERS_FIELD False Name of the users in the result. Default: uniqueMember

Mapping groups

To define the link between an LDAP search and a DataWarehouse group it's necessary to create LDAPGroupLink objects, which can be done by an administrator through the admin interface.

The LDAPGroupLink object contains 2 required values: group and filter_query plus an extra extra_users to force users to be part of the group if they're not in the LDAP groups, which is useful for assigning service accounts which are not linked to LDAP users.

For example:

  • group: policy_read_internal
  • filter_query: (&(objectClass=rhatRoverGroup)(cn=cki-datawarehouse-internal-read))
  • extra_users: [sa_reporter]