Doubts on LDAP integration

Hello,
good points from Justin there.

What you would do is to create the user groups in the LDAP corresponding to the groups in CQ. Eg. have a group in the LDAP that is named "supergroup". Then when the first user belonging to that group is logging into CQ, that group will also be created in CQ. Set the right permissions to that group and the rest of the people logging in with that group as their group will get the right permissions. Always try to set permissions on group level and not on a single user.

It should be possible AFAIK to create that specific group in advance and already set the correct permissions so that every user, even if it is the first one, that logs in with that group will be added to it and auto. recieve the right permissions.

/Johan

Well said Johan.

Sam,

for recent versions of AEM an sync of all users to AEM is possible and described in the documentation [1]; in CQ 5.4 (which is indeed quite old) the option to import all users from LDAP already existed, IIRC in the CRX Explorer (http://localhost:4502/crx/explorer/index.jsp).

[1] http://dev.day.com/docs/en/cq/current/core/administering/ldap_authentication.html#LDAP%20User%20Synchronization%20and%20Purging

Hello Justin,

Thank you for your help. I did not understand what could be the issue with ldap set up. I've attached screenshot here of my new ldap user. Could you please explain bit? 

I have following entry in ldap_login.conf - 

com.day.crx {
   com.day.crx.core.CRXLoginModule sufficient;
   com.day.crx.security.ldap.LDAPLoginModule required
              principal_provider.class="com.day.crx.security.ldap.principals.LDAPPrincipalProvider"
              host="localhost"
              port="10389"
              secure="false"
              authDn="uid=admin,ou=system"
              authPw="secret"
              userRoot="ou=users,ou=system"
      userIdAttribute="userid"
      userFilter="(objectClass=*)"
              groupRoot="ou=groups, o=example"
              groupMembershipAttribute="uniquemember"
              autocreate="create"
              autocreate.user.membership="contributor"
              autocreate.user.mail="rep:e-mail"
              autocreate.user.cn="rep:fullname"
              autocreate.group.description="description"
              autocreate.group.mail="rep:e-mail"
              autocreate.group.cn="rep:fullname"
              autocreate.path="direct"
              cache.expiration="600"
              cache.maxsize="100";
};

I've followed this and as per explanation in section "Validate CQ-ApacheDS integration", it says the same problem which I am trying to automate. 

Kindly let me know if I'm missing something. 

Sam

Thank you all for your help...now my doubt is clear