Betreff: AEM ldap Integration: How to sync groups from ldap users

[Magicr]

Hello,

I'm using this modul to synchronize users from active directory. The sync action with users works well. My requriemtent is I also need to create groups which are the users are  members of. How can I achive this?

Thanks in advanced.  

[Saravanan_Dharmaraj]

Please check the below blog on how to set up the groups in AEM

https://www.tothenew.com/blog/ldap-integration-with-aem-apache-directory-server/ 

[Magicr]

---

@Saravanan_Dharmaraj  schrieb:

Please check the below blog on how to set up the groups in AEM

https://www.tothenew.com/blog/ldap-integration-with-aem-apache-directory-server/ 

---

Thanks for your answer. The posted link could not help me to solve my issue.

From offcial site from Adobe - https://experienceleague.adobe.com/docs/experience-manager-64/administering/security/ldap-config.htm... - I enabled the logging for ExternalLoginModule and Authatication.

The created log file contains a huge number of 

 org.apache.jackrabbit.oak.spi.security.authentication.external.impl.ExternalLoginModule No 'SupportedCredentials' configured. Using default implementation supporting 'SimpleCredentials'.

Could it be the reason why I'm unable to get groups from ldap? How can I fix it? The research for this message points always here to an post in this forum. The containing link points to a todo list which I have already followed.

[Chandra_Hire]

Hi @Magicr 

Please check the configuration for reference

HOW TO SYNCHRONIZE AEM WITH LDAP USERS AND GROUPS (aemsigma.blogspot.com)

[Magicr]

I followed this list on a fresh new instance and it could not fix the issue. Users are imported, groups not.

[Magicr]

Maybe I found a helpful log entry who disappears between all lines of debug output. The following output is

*DEBUG* [qtp31820972-1821] org.apache.jackrabbit.oak.security.authentication.ldap.impl.LdapIdentityProvider getDeclaredGroupRefs: search below OU=xxx,DC=example,DC=com with (& (xxx)) found 0 entries. (connect=1,99ms, search=963,00us, iterate=2,38ms)

Actually this makes sense why groups are not created.

[Chandra_Hire]

Please check with LDAP administrator for value of 'Bind DN' & 'Group DN' configuration in Identity Provider OSGi configuraiton. 

[makzare1463]

Through admin console you get ldap and group create with email start sync and integration.

[Magicr · Accepted solution]

I think I could solve my issue. by doing three things:

1. Disabling the option "Dynamic membership".
2. Add a slash at begin to properties where you can define users and groups are stored.
3. By using simple queries first I found out all my queries where "wrong", even though they generated valid results in AEM it self. The fields user extra filters and group extra filters does contains only the "second" part of a query.
   Query example:

   (&(objectClass=<person/group>)(|(memberOf=CN=sug-xxx,OU=groupfolder,DC=exampledomain,DC=com)(memberOf=CN=sug-yyy,OU=groupfolder,DC=exampledomain,DC=com))
   

   So the working result for me was adding below query to filter fields:

   (|(memberOf=CN=sug-xxx,OU=groupfolder,DC=exampledomain,DC=com)(memberOf=CN=sug-yyy,OU=groupfolder,DC=exampledomain,DC=com))
   

   Due to the fact there exists no well explained examples at the Internet and by missleading log output this was a big exploration journey for me.