Edit Question - KnowledgeHub

Title Body

I successfully have my Rails 3 app running with devise and devise_ldap_authenticatable to authenticate against the local Active Directory. Now I want to add authorization capabilities in order to allow access only to AD users that belong to certain AD groups. So to start simple, I first have looked up my own user in AD with the linux command ldapsearch. The result contained something like ... (...) memberOf: CN=my,OU=foo,DC=bar,DC=role,DC=domain,DC=com memberOf: CN=my,OU=foo,DC=bar2,DC=role,DC=domain,DC=com memberOf: (...) (...) Ok, now I decided, that I want to restrict access to members of CN=my,OU=foo,DC=bar,DC=role,DC=domain,DC=com. So, I changed my ldap.yml to contain: authorizations: &AUTHORIZATIONS group_base: ou=role,dc=domain,dc=com required_groups: - CN=my,OU=foo,DC=bar,DC=role,DC=domain,DC=com development: (...) <<: *AUTHORIZATIONS And in addition changed my devise.rb to contain: Devise.setup do |config| config.ldap_logger = true config.ldap_create_user = true config.ldap_update_password = false config.ldap_check_group_membership = true # <-- activated this line config.ldap_use_admin_to_bind = true #config.ldap_ad_group_check = true <-- don't know what this is good for Now, when trying to authenticate, access is denied, which I did not expect: User CN=myuser,OU=org,DC=domain,DC=com is not in group: CN=my,OU=foo,DC=bar,DC=role,DC=domain,DC=com Any idea, how authorization against AD is accomplished with devise_ldap_authenticatable? The documentation of this module is not yet that comprehensive when it comes to authorization.

Tags (comma-separated) Cancel