The can be configured to support the use of groups for users.
You must enable and configure one of the supported SSO integration methods.
Please review and set the following platform settings.
Locate the following settings and apply values as needed:
|"feature.groups.enabled"||Set this value to |
Set this value to the LDAP search result parameter containing the value to be used as the name of a group in the . This value must have unique values, since groups in the must have unique names.
|"feature.groups.ldapServers"||(optional) An array of parameters, listing LDAP servers to use for synching of groups. If this parameter is not specified, then the LDAP server specified in the parameter |
(optional) You must provide at least one search filter string to use to query the LDAP servers for groups. The following example searches for all groups named
If editing this parameter through , this value must be stored as an array with appropriate syntax:
A search filter doesn't need to use the
Each search filter must include parentheses at the beginning and the end.
Each filter string is expected to return a single item. If the search results include multiple items, only the first item is used.
If this value is empty, no groups are synched.
All users must be created in the .
NOTE: The email address for the user in the must match the LDAP email attribute.
For more information on creating users via API, see
After the platform users and groups have been synched with the LDAP identity provider:
If an LDAP user has no corresponding user at the time of synching, the platform user is automatically added to the group and inherits the group's permissions when the account is created.
NOTE: If a user is removed from an LDAP group, the user remains a member of the platform group until groups are synched again. When groups are synched, the user is removed from the group and loses access to any objects shared with the group.
You can use the following endpoint to sync the platform with the configured LDAP servers for their groups.
NOTE: This endpoint must be triggered using an admin account.
|Response Status Code||200 - OK|
The response body contains the list of groups that have been added or removed based on the synching:
\character indicates that the line continues on the following line.
curl -X POST \ http://www.example.com:3005/v4/groups/syncGroups \ -H 'authorization: Basic <auth_token>' \ -H 'cache-control: no-cache'