Hi, all! Help, please.
I am trying to use page access management by managing Active Directory groups by LDAP Authencator. Some pages can be seen only by a few users, so I created special AD groups for this and I am mapping these groups to local XWiki groups.
Idea is that I configured view rights to some page for special group, mapped from AD. If I want some user to be able to view this page, I just add his AD account to this group at AD, if I want him not to be able to view - I remove him from AD group.
When I add user to group at AD, it works fine - after login he is in mapped local group and can see the page. But when I remove this user from AD group, he is still in mapped group and still can see the page! I can remove him by admin’s account at web-interface, but I want this to happen automatically by manipulating with AD groups.
I was trying to re-login this user many times, restarting all XWiki etc. Our wiki is XWiki Debian 17.4.1 with LDAP Authenticator 9.16.1
Here is part of xwiki.cfg about LDAP:
xwiki.superadminpassword=pass
xwiki.authentication.cookiedomains=
xwiki.authentication.logoutpage=(/|/[^/]+/|/wiki/[^/]+/)logout/*
xwiki.authentication.authclass=org.xwiki.contrib.ldap.XWikiLDAPAuthServiceImpl
xwiki.authentication.ldap=1
xwiki.authentication.ldap.trylocal=1
xwiki.authentication.ldap.server=dc1.f.local
xwiki.authentication.ldap.port=636
xwiki.authentication.ldap.ssl=1
xwiki.authentication.ldap.base_DN=DC=f,DC=local
xwiki.authentication.ldap.bind_DN=CN=ldapreader,OU=ServiceAccount,DC=f,DC=local
xwiki.authentication.ldap.bind_pass=pass
xwiki.authentication.ldap.UID_attr=sAMAccountName
xwiki.authentication.ldap.fields_mapping=name=sAMAccountName,last_name=sn,first_name=givenName,fullname=displayName,email=mail
xwiki.authentication.ldap.user_group=CN=XWiki,OU=XWiki,OU=Technical Account,DC=f,DC=local
xwiki.authentication.ldap.group_mapping=XWikiAD_Admins=CN=XWikiAD_Admins,OU=XWiki,OU=Technical,DC=f,DC=localWiki_Page=CN=XWiki_Page,OU=PagesAccess,OU=XWiki,OU=Technical,DC=f,DC=local
xwiki.authentication.ldap.update_user=1
xwiki.authentication.ldap.mode_group_sync=always
xwiki.authentication.ldap.groupcache_expiration=900