You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/en/user-manual/advanced_configuration.md
+22Lines changed: 22 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -860,6 +860,28 @@ created on those organizations if `auto_create` is enabled.
860
860
Refer to [Accessing Users in Other Organizations](https://adobe-apiplatform.github.io/user-sync.py/en/user-manual/advanced_configuration.html#accessing-users-in-other-organizations)
861
861
for more information.
862
862
863
+
## Two-Step Lookup
864
+
865
+
Some LDAP systems may not support a `memberOf` overlay the way other systems like Active Directory do. This can make it
866
+
impossible for the LDAP connector to use its group-based queries to get members for particular groups in an LDAP system.
867
+
868
+
The `two_steps_lookup` option in `connector-ldap.yml` can be used to overcome this limitation. With two-step lookup
869
+
enabled and configured, the sync tool will retrieve group membership from the specified `group_member_attribute_name`
870
+
attribute. User metadata from these queries is then verified to be part of the `base_dn` and the full user record is retrieved.
871
+
872
+
Example:
873
+
874
+
```yaml
875
+
two_steps_lookup:
876
+
group_member_attribute_name: "member"
877
+
nested_group: False
878
+
```
879
+
880
+
`group_member_attribute_name`defines the user attribute to use for group membership information. `nested_group` will
881
+
recursively query nested group memberships.
882
+
883
+
**NOTE:** `group_member_filter_format` may not be defined when two-step lookup is enabled.
0 commit comments