Search code examples
ldapwso2

WSO2 APIM 4.0.0 - Groups are not assigned to Users

I'm trying to configure API Manager 4.0.0 against OpenLDAP.

The users and groups are correctly fetched from the ldap and I can see them on carbon UI.

When I navigate to "View Users" of one group, I can see the users that are fetched using the attribute "uniqueMember" of the ldap.

But when I navigate to "View Roles" of one user, only "Internal/everyone" is displayed. The groups of the user are not assigned to him.

Is it normal to see the relationship in one way only ?

My OpenLDAP has no "memberOf" attribute schema. Maybe it is required ?

I am using a fresh install from wso4am-4.0.0.zip all-in-one without modification.

Here is the configuration of the userstore:

<?xml version="1.0" encoding="UTF-8"?><UserStoreManager class="org.wso2.carbon.user.core.ldap.UniqueIDReadWriteLDAPUserStoreManager">
      <Property name="ConnectionURL">ldap://xxx:389</Property>
      <Property name="ConnectionName">cn=admin,dc=mycompany-dev,dc=fr</Property>
      <Property encrypted="true" name="ConnectionPassword">xxx</Property>
      <Property name="UserSearchBase">ou=Users,ou=wso2,dc=mycompany-dev,dc=fr</Property>
      <Property name="UserEntryObjectClass">person</Property>
      <Property name="UserNameAttribute">uid</Property>
      <Property name="UserNameSearchFilter">(&amp;(objectClass=person)(uid=?))</Property>
      <Property name="UserNameListFilter">(objectClass=person)</Property>
      <Property name="UserIDAttribute">scimId</Property>
      <Property name="UserIdSearchFilter">(&amp;(objectClass=person)(uid=?))</Property>
      <Property name="UserDNPattern"/>
      <Property name="DisplayNameAttribute"/>
      <Property name="Disabled">false</Property>
      <Property name="ReadGroups">true</Property>
      <Property name="WriteGroups">true</Property>
      <Property name="GroupSearchBase">ou=Groups,ou=wso2,dc=mycompany-dev,dc=fr</Property>
      <Property name="GroupEntryObjectClass">groupOfUniqueNames</Property>
      <Property name="GroupNameAttribute">cn</Property>
      <Property name="GroupNameSearchFilter">(&amp;(objectClass=groupOfUniqueNames)(cn=?))</Property>
      <Property name="GroupNameListFilter">(objectClass=groupOfUniqueNames)</Property>
      <Property name="RoleDNPattern"/>
      <Property name="MembershipAttribute">uniqueMember</Property>
      <Property name="MemberOfAttribute"/>
      <Property name="BackLinksEnabled">true</Property>
      <Property name="UserNameJavaRegEx">[a-zA-Z0-9._-|//]{3,30}$</Property>
      <Property name="UserNameJavaScriptRegEx">^[\S]{3,30}$</Property>
      <Property name="UsernameJavaRegExViolationErrorMsg">Username pattern policy violated.</Property>
      <Property name="PasswordJavaRegEx">^[\S]{5,30}$</Property>
      <Property name="PasswordJavaScriptRegEx">^[\S]{5,30}$</Property>
      <Property name="PasswordJavaRegExViolationErrorMsg">Password pattern policy violated.</Property>
      <Property name="RoleNameJavaRegEx">[a-zA-Z0-9._-|//]{3,30}$</Property>
      <Property name="RoleNameJavaScriptRegEx">^[\S]{3,30}$</Property>
      <Property name="LDAPInitialContextFactory">com.sun.jndi.ldap.LdapCtxFactory</Property>
      <Property name="DateAndTimePattern">Date And Time Pattern</Property>
      <Property name="CaseInsensitiveUsername">true</Property>
      <Property name="BulkImportSupported">true</Property>
      <Property name="EmptyRolesAllowed">true</Property>
      <Property name="PasswordHashMethod">PLAIN_TEXT</Property>
      <Property name="MultiAttributeSeparator">,</Property>
      <Property name="MaxUserNameListLength">100</Property>
      <Property name="MaxRoleNameListLength">100</Property>
      <Property name="kdcEnabled">false</Property>
      <Property name="defaultRealmName">WSO2.ORG</Property>
      <Property name="UserRolesCacheEnabled">false</Property>
      <Property name="ConnectionPoolingEnabled">false</Property>
      <Property name="LDAPConnectionTimeout">5000</Property>
      <Property name="ReadTimeout">5000</Property>
      <Property name="RetryAttempts">0</Property>
      <Property name="CountRetrieverClass"/>
      <Property name="java.naming.ldap.attributes.binary"/>
      <Property name="ClaimOperationsSupported">true</Property>
      <Property name="MembershipAttributeRange">0</Property>
      <Property name="UserCacheExpiryMilliseconds"/>
      <Property name="UserDNCacheEnabled">true</Property>
      <Property name="StartTLSEnabled">false</Property>
      <Property name="ConnectionRetryDelay">120000</Property>
      <Property name="ImmutableAttributes"/>
      <Property name="TimestampAttributes"/>
      <Property name="DomainName">CompanyUsers</Property>
      <Property name="Description"/>
</UserStoreManager>
Solution

  • FYI I found the answer after activating logs :

    DEBUG {org.wso2.carbon.user.core.ldap.UniqueIDReadOnlyLDAPUserStoreManager} - No UserID found for the property: uid, value: user1, in domain: COMPANYUSERS

    My user was incorrectly fetched because of scimId not exists in my Ldap

    <Property name="UserIDAttribute">scimId</Property>

    I changed to uid and it is working now.

    <Property name="UserIDAttribute">uid</Property>