Importing Active Directory Groups
About this task
One of the greatest benefits of integrating with Active Directory is being able to use existing
Active Directory groups. After Active Directory groups are imported, an administrator must
define the permissions for each group and group membership is handled inherently by Active
Directory. To import Active Directory groups, configure the following properties in the
ldap.properties file.
Note: If the Active
Directory server is a global catalog you can successfully import all groups in the domain
forest however only the members of the Universal Groups will be automatically assigned to
them. This occurs because Universal Groups are the only group type whose full membership
list replicates to every Global Catalog server in the forest. So other groups type don’t
report membership information on the global catalog.
- ldap.groupName
- The LDAP attribute name that is used for the group search.
ldap.groupName=cn OR ldap.groupName=name - ldap.groupDescription
- The LDAP attribute name to be used to get the description for the group. It is set
to description by default.
ldap.groupDescription=description - ldap.groupNameTrim
- Set to true or false. Limits the group name that is imported to the Remote Control database to 64 characters. The recommended value is false.
- ldap.groupMembers
- LDAP attribute name to be used to find the members of the groups that are returned
as a result of the specified search. The default value is member.
ldapgroupMembers=member - ldap.groupSubtree
- If set to true, Remote Control searches recursively through the subtree of the element that is specified in the ldap.groupBase parameter for groups that are associated with a user. If left unspecified, the default value of false causes only the top level to be searched, and no recursive search is run. True or False (default).
- ldap.groupBase
- The base LDAP directory entry for starting the search for groups to synchronize. If
left unspecified, the default is to use the top-level element in the directory
context.
To refine your search and go deeper into the OU structure, select to start the search only within a specific organizational unit. For example, an OU called Test. Set the property to the following value.for example OU=mylocation,DC=mycompany,DC=com
Therefore, Remote Control looks for groups that match the criteria, only within the Test OU (and any OUs that belong to the Test OU if ldap.groupSubtree is set to true).OU=Test,OU=mylocation,DC=mycompany,DC=com - ldap.groupSearch
- Defines the LDAP query that is used to import AD groups to Remote Control.
The defined query needs to filter the results such that only those groups that are
needed are imported to Remote Control.
ldap.groupSearch=(objectClass=group)- Imports all AD groups found in the OU specified in the ldap.groupBase property to Remote Control. Some environment can have thousands of groups.
ldap.groupSearch=(&(objectClass=group)(cn=*SMS*))- Imports all groups that contain SMS in the cn attribute. For example, visio-sms-users.
ldap.groupSearch=(&(objectClass=group)(cn=admins))- Imports all groups that are named admins.
ldap.groupSearch=(&(objectClass=group)(cn=admins*))- Imports all groups that have the text admins in the name. For example, administrators, server-administrators.
- ldap.groupMembers
- LDAP attribute name to be used to find the members of the groups that are returned as a result of the specified search. The default value is member.