Ldap - many domains - mapping groups

Help / Discuss
,
#1

Hi, everybody
I’m sorry for my English
I need your help
I have a lot of domains, I’m trying to set up proper authorization on my xwiki + ldap - ad user group mapping
Here is my config:

xwiki.authentication.ldap.bind_DN=CN=XWIKI.Ldap,OU=XWIKI,OU=SVC,DC=sib,DC=xxx,DC=yyy
xwiki.authentication.ldap.bind_pass=@@@@
xwiki.authentication.ldap.UID_attr=sAMAccountname
xwiki.authentication.ldap.remoteUserParser=(.+)\\\\(.+)
xwiki.authentication.ldap.remoteUserMapping.2=uid
xwiki.authentication.ldap.remoteUserMapping.1=domain,ldap_server,ldap_port,ldap_base_DN
xwiki.authentication.ldap.remoteUserMapping.ldap_server=sib=sib.xxx.yyy|msk=msk.zzz.yyy
xwiki.authentication.ldap.remoteUserMapping.ldap_port=sib=389|msk=389
xwiki.authentication.ldap.remoteUserMapping.ldap_base_DN=sib=DC=sib,DC=xxx,DC=yyy|msk=DC=msk,DC=zzz,DC=yyy
xwiki.authentication.ldap.fields_mapping=last_name=sn,first_name=givenName,fullname=userPrincipalName,email=mail,phone=telephoneNumber
xwiki.authentication.ldap.group_classes=group,groupOfNames,groupOfUniqueNames,dynamicGroup,dynamicGroupAux,groupWiseDistributionList,posixGroup,apple-group
xwiki.authentication.ldap.group_memberfields=member,uniqueMember,memberUid
xwiki.authentication.ldap.update_user=1
xwiki.authentication.ldap.mode_group_sync=always
xwiki.authentication.ldap.groupcache_expiration=600
xwiki.authentication.ldap.group_mapping=XWiki.FAQ for dispatchers=CN=XWIKI.FAQ for dispatchers,OU=XWIKI,OU=SVC,DC=sib,DC=xxx,DC=yyy|\
XWIKI.FAQ for user support=CN=XWIKI.FAQ for user support,OU=XWIKI,OU=SVC,DC=sib,DC=xxx,DC=yyy|\
XWIKI.FAQ Infrastructure=CN=XWIKI.FAQ Infrastructure,OU=XWIKI,OU=SVC,DC=sib,DC=xxx,DC=yyy|\
XWIKI.IT Infrastructure=CN=XWIKI.IT Infrastructure,OU=XWIKI,OU=SVC,DC=sib,DC=xxx,DC=yyy|\
XWIKI.WRITE-FAQ for dispatchers=CN=XWIKI.WRITE-FAQ for dispatchers,OU=XWIKI,OU=SVC,DC=sib,DC=xxx,DC=yyy|\
XWIKI.WRITE-FAQ for user support=CN=XWIKI.WRITE-FAQ for user support,OU=XWIKI,OU=SVC,DC=sib,DC=xxx,DC=yyy|\
XWIKI.WRITE-FAQ Infrastructure=CN=XWIKI.WRITE-FAQ Infrastructure,OU=XWIKI,OU=SVC,DC=sib,DC=xxx,DC=yyy|\
XWIKI.WRITE-IT Infrastructure=CN=XWIKI.WRITE-IT Infrastructure,OU=XWIKI,OU=SVC,DC=sib,DC=xxx,DC=yyy|\
XWIKI.Admin=CN=XWIKI.Admin,OU=XWIKI,OU=SVC,DC=sib,DC=xxx,DC=yyy
xwiki.authentication.ldap.userPageName=${ldap.userPrincipalName}

Authorization is correct: domain\login
But the groups are not matched.
Groups are located in the main domain, users in different.
I use a reader account to search for users. He is in the domain: CN=XWIKI.Ldap,OU=XWIKI,OU=SVC,DC=sib,DC=xxx,DC=yyy
It seems to me that when the reader finds a user in the right domain, accordingly, it tries to find groups to match in the same domain. but they are not there.
What am I doing wrong? Please help - I am very tired with this problem.

#2

Is xwiki.authentication.ldap.group_mapping a single line for you? Otherwise you need to add \ as a newline break. We have all groups started with XWiki. not XWIKI. but not sure if caps matter here. Furthermore, are you sure your user has the according groups?

#4

xwiki.authentication.ldap.group_mapping - yes it is one line
Yes, I am sure that users have groups