AEM with Active Directory

[francisco_ribei]

Hi,

Does anyone have set AEM log against an AD Server and Sync the groups?

I am able to log using an user from LDAP and Sync it on AEM, but the groups are not being imported. Could someone help me on this?

The Group Base DN is correct.

For Group Object Class I'm using: group

And for Group Member Attribute: member

Any help is welcome.

Thanks

[Lokesh_Shivalingaiah]

Only Users get syncd. You need to create mapping for the group which is already existing in crx to be mapped when the user is created/syncd from LdAP

[Lokesh_Shivalingaiah]

Refer [1] for the same

autocreate.user.membership="contributor" is the property to be used to map to the existing group when use is auto created.

[1] https://docs.adobe.com/docs/en/cq/5-6-1/core/administering/ldap_authentication.html

[francisco_ribei]

Hi bloski,

So AEM doesn´t bring the Groups from AD to the repository?

[francisco_ribei]

Hi,

I am using 6.1, is this config valid for 6.1 as well?

Thanks

[Lokesh_Shivalingaiah]

Yes... You need to create the LDAP groups in AEM and you can map to the same group while syncing the users. Its mainly to sync the users.

[Opkar_Gill]

As far as I can remember, and it has been a while since I used LDAP, you should be able to synch users and groups. The documentation does mention this[1], see below

A Word on Group Affiliation

Users synchronized through LDAP can be part of different groups in AEM. These groups can be external LDAP groups that will be added to AEM as part of the synchronization process, but they can also be groups that are added separately and are not part of the original LDAP group affiliation scheme.

EDIT: have you enabled debugging for LDAP to see what is going on?

Regards,

Opkar

[1] https://docs.adobe.com/docs/en/aem/6-1/administer/security/ldap-config.html

[2] https://github.com/Adobe-Marketing-Cloud/aem-ldap-tutorial

[francisco_ribei]

Hi Opkar,

I've enabled the ldap log, but it doesn't display anything about groups sync.

It just displays the user authenticating against the AD server.

Is there any other configuration that I can check?

Thanks

[Opkar_Gill · Accepted solution]

Hi,

So you see nothing when you set debug level logging?[1]

what value have you set for "User membership nesting depth"[2]?

Regards,

Opkar

[1] https://docs.adobe.com/docs/en/aem/6-1/administer/security/ldap-config.html#Enabling debug logging

[2] https://docs.adobe.com/docs/en/aem/6-1/administer/security/ldap-config.html#Configuring The Synchronization Handler

[francisco_ribei]

Hi opkar,

I was able to make the group sync. As you said I didn't set the User membership nesting depth, so I set that to 1.

And another thing was to change the  Group object classes  to be group and the  Group member attribute  to member.

Thanks for your help.