Hello,
I have tried to activate LDAP but I cannot have a group mapping (every user are viewers or cannot login with group not found).
I have found the solution below but the behaviour is strange.
Here are the setup :
grafana V5.4.2
local openldap V2.4.44-20 on redhat 7.5
GRAFANA.INI :
[auth.ldap]
enabled = true
config_file = /etc/grafana/ldap.toml
allow_sign_up = true
LDAP.TOML
[[servers]]
host = “127.0.0.1”
port = 389
use_ssl = false
start_tls = false
ssl_skip_verify = false
bind_dn = “uid=grafadmin,ou=User,dc=grafana,dc=local”
bind_password = ‘*************’
search_filter = “(uid=%s)”
search_base_dns = [“dc=grafana,dc=local”]
group_search_filter = “(&(objectClass=posixGroup)(memberUid=%s))”
group_search_base_dns = [“ou=Group,dc=grafana,dc=local”]
group_search_filter_user_attribute = “uid”
[servers.attributes]
name = “givenName”
surname = “sn”
username = “cn”
email = “mail”
[[servers.group_mappings]]
group_dn = “cn=grafadmins,ou=Group,dc=grafana,dc=local”
org_role = “Admin”
[[servers.group_mappings]]
group_dn = “cn=grafeditors,ou=Group,dc=grafana,dc=local”
org_role = “Editor”
[[servers.group_mappings]]
group_dn = “cn=grafviewers,ou=Group,dc=grafana,dc=local”
org_role = “Viewer”
PROBLEM
I am trying to log as user “pmi” (ldap configured with LDAPAdmin, see view attached)
I get a cannot login with “user does not belong in any of the specified ldap groups”
It works with :
group_dn = “*”
org_role = “Viewer”
But the user is Viewer instead of Editor.
SOLUTION FOUND
using group_search_filter_user_attribute = “cn” (instead of =“uid”) works.
But “uid” should have worked.
Regards