Import and authenticate users from a particular group in Active Directory

Issue

• Instead of importing and authenticating all users from Microsoft Active Directory (AD), I would like to only import and authenticate users from a particular group in AD.

Environment

• Liferay DXP 7.3

Resolution

1. In the Authentication Search Filter, specify the filter like this:
   

   (&(objectCategory=person)(mail=@email_address@)(memberOf=cn=$Group_name,dc=mydomain,dc=com))

   
   For multiple groups, the filter is like this:
   

   (&(objectCategory=person)(|(memberOf=cn=$Group1_name,dc=mydomain,dc=com)(memberOf=cn=$Group2_name,dc=mydomain,dc=com)))

2. In the Groups > Import Search Filter, specify the filter like this:
   

   (&(objectClass=person)(memberOf=cn=$Group_name,dc=mydomain,dc=com))

   
   For multiple groups, change the search filter like this:
   

   (&(objectClass=person)(|(memberOf=cn=$Group1_name,dc=mydomain,dc=com)(memberOf=cn=$Group2_name,dc=mydomain,dc=com)))

 

Additional Information

• "$Group_name", "$Group1_name", "$Group2_name", should be changed to the group name in AD.
• If the group name contains a special character (e.g. #), the special character should be escaped with "\\" in the Authentication Search Filter like this:
  

  (&(sAMAccountName=@screen_name@)(|(memberOf=cn=\\#group1,ou=groupTest,dc=mydomain,dc=com)(memberOf=cn=\\#group2,ou=groupTest,dc=mydomain,dc=com)))

• When clicking 'Test LDAP Users', only users with defined security group/s will be listed.
• Wildcards are not supported for memberof attributes. Details can be found here.