# Role Search filter for LDAP Authentification

**URL:** <https://forum.inductiveautomation.com/t/role-search-filter-for-ldap-authentification/5705>\
**Category:** Ignition\
**Created:** [January 21, 2013, 2:34pm UTC](https://forum.inductiveautomation.com/t/role-search-filter-for-ldap-authentification/5705 "2013-01-21T14:34:22Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\
**Post date:** [January 21, 2013, 2:34pm UTC](https://forum.inductiveautomation.com/t/role-search-filter-for-ldap-authentification/5705/1 "2013-01-21T14:34:22Z")

</div>

I try to configure Ignition to use LDAP Authentification.

Ignition v7.5.5  
The LDAP is openDS version 2.2  
Users and Roles are configured as follows :

in openDS :

 ![](https://us1.discourse-cdn.com/inductiveautomation/original/2X/f/f1e5f236411defa53bbbdaa573ab677ccf062c7d.jpg)  

in Ignition :

```auto
Username Prefix : uid=
Username Suffix : ,ou=utilisateurs,dc=itinisere,dc=fr
User Search Base : dc=itinisere,dc=fr
ser Search Filter : (&(objectClass=utilisateur)(uid={0}))
User Name Attribute : uid
User Name Attribute :
Role Name Attribute : cn
Role Search Base :
Role Search Filter : (&(objectClass=groupOfUniqueNames)(uniqueMember=uid={0},ou=utilisateurs,dc=itinisere,dc=fr))
```

I’ve actived the log for SimpleLDAPAuthentificator :

Connection to the LDAP is OK  
Serching user is OK  
Listing Roles is BAD

 ![](https://us1.discourse-cdn.com/inductiveautomation/original/2X/e/eeeff90660f1d7e4c8a56aedc895d01cf5a61eae.jpg)  

When I try the LDAP Filter in openDS to list the roles of the user, i get the right data :

 ![](https://us1.discourse-cdn.com/inductiveautomation/original/2X/6/6712c8a89783591b9cdb2c63c656cdf1ce32bcb6.jpg)  

Is {0} supported in the Role Search Filter ???  
How to get the user’s roles in my case?

---

<div class="post-metadata">

**Author:** ![Travis.Cox](https://avatars.discourse-cdn.com/v4/letter/t/b9bd4f/32.png) [@Travis.Cox](https://forum.inductiveautomation.com/u/Travis.Cox)\
**Post date:** [January 21, 2013, 4:46pm UTC](https://forum.inductiveautomation.com/t/role-search-filter-for-ldap-authentification/5705/2 "2013-01-21T16:46:49Z")

</div>

No, we don’t support the {0} in the role filter. We expect the user has an attribute (user role attribute) that contains the roles and is an array. When I have configured OpenDS I had to use a specific attribute and manually put the roles in for each user.

---

<div class="post-metadata">

**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\
**Post date:** [March 7, 2013, 4:44pm UTC](https://forum.inductiveautomation.com/t/role-search-filter-for-ldap-authentification/5705/3 "2013-03-07T16:44:34Z")

</div>

Yes, it works in this case, but I have a problem. ☹

In my case, OpenDS administrator doesn’t want to add an attribut on the user class with the link to the roles class.  
So I can’t configure the “User Role Attribute” on the authentification profile !  
👿

In fact, in his configuration, the roles class contains attributes “uniqueMenber” with the user reference (uid=loperateur,ou=utilisateurs,dc=itinisere,dc=fr)

Is there a way to configure the authentification Profile or to upgrade it, so that the roles check could be directly based on the Roles class  
instead of looking for an atributes for the roles on the user class ?

In this case, for example, by leaving blank “User Role Attribute” or set to a special value,  
and setting the field “Role Search Filter” : (&(objectClass=groupOfUniqueNames)(uniqueMember=uid={0},ou=utilisateurs,dc=itinisere,dc=fr))  
where {0} is the login

---

<div class="post-metadata">

**Author:** ![Travis.Cox](https://avatars.discourse-cdn.com/v4/letter/t/b9bd4f/32.png) [@Travis.Cox](https://forum.inductiveautomation.com/u/Travis.Cox)\
**Post date:** [March 7, 2013, 8:04pm UTC](https://forum.inductiveautomation.com/t/role-search-filter-for-ldap-authentification/5705/4 "2013-03-07T20:04:58Z")

</div>

It would be possible for you to create your own module (in the Module SDK) that exposes a new authentication profile. I don’t think we are going to modify ours to work in that situation since most of them the roles are part of the user.

---

<div class="post-metadata">

**Author:** ![Robert](https://avatars.discourse-cdn.com/v4/letter/r/e95f7d/32.png) [@Robert](https://forum.inductiveautomation.com/u/Robert)\
**Post date:** [March 7, 2013, 10:44pm UTC](https://forum.inductiveautomation.com/t/role-search-filter-for-ldap-authentification/5705/5 "2013-03-07T22:44:09Z")

</div>

Maybe the Hybrid model is the way to go.  
Keep the roles in ignition and user authentication in OpenDS

---

<div class="post-metadata">

**Author:** ![diat150](https://avatars.discourse-cdn.com/v4/letter/d/a587f6/32.png) [@diat150](https://forum.inductiveautomation.com/u/diat150)\
**Post date:** [March 8, 2013, 12:29am UTC](https://forum.inductiveautomation.com/t/role-search-filter-for-ldap-authentification/5705/6 "2013-03-08T00:29:37Z")

</div>

[quote=“Robert”]Maybe the Hybrid model is the way to go.  
Keep the roles in ignition and user authentication in OpenDS[/quote]

yes, and the best way to handle an IT person that doesnt want to play ball.

---

<div class="post-metadata">

**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\
**Post date:** [March 8, 2013, 9:03am UTC](https://forum.inductiveautomation.com/t/role-search-filter-for-ldap-authentification/5705/7 "2013-03-08T09:03:20Z")

</div>

Thanks !  
AD/hybrid is a good compromise