Generate role with sAMAccountName from each user of a group

Hi, We have already sharing about my problem with @bersace. So you send me this config for sync_map:

- ldap:
    base: ou=users,ou=site,ou=oncodesign,dc=ldap,dc=local 
    attributes: sAMAccountName
  roles:
  - name_attribute: sAMAccountName
    options: LOGIN
- ldap:
    base: ou=groups,ou=site,ou=oncodesign,dc=ldap,dc=local 
    attributes: [groupname, members]
  roles:
  - name_attribute: groupname
    options: NOLOGIN
    member_attribute: members

I had adapted this config like this:

- ldap:
    base: ou=users,ou=site,ou=oncodesign,dc=ldap,dc=local
    filter: "(objectClass=User)"
    attributes: sAMAccountName
  roles:
    name_attribute: sAMAccountName
    options: LOGIN
- ldap:
    base: ou=groups,ou=site,ou=oncodesign,dc=ldap,dc=local
    filter: "(cn=NameofGroup)"
    attributes: [member, cn]
  roles:
    name_attribute: member
    options: NOLOGIN
    member_attribute: cn

I had change “groupename and member” attributes because they are not recognized by AD.

So after start ldap2pg in dry mode, the script would create role for all users in OU Users but not only users member of my specified group.

Maybe I need to extract CN user from a first research to the group and next creat a sync_map for each user returned to take his sAMAccountName for create a role with this name. But I don’t know how to do this.

Thanks for support 😃

[cbandy]

If you want to limit the users to a particular AD group, maybe put that group in the filter?

untested:

filter: >
  (&
    (objectClass=User)
    (memberOf=cn=YourGroupHere,ou=groups,ou=site,ou=oncodesign,dc=ldap,dc=local)
  )

[bersace]

@EagleEnergy no worry 😃