LDAP Sync syncs every user instead of specified group

[twilcox]

I'm trying to set up an ldap source for authentication. I can't seem to get it to sync only one specific group. I've tried adding the name of the group to "group filter" in the sync options tab after double clicking on the authentication source.

How can I just sync one group instead of everyone?

 

[t.lamprecht]

Hi,

so just to clarify, you want one group and all of its users to get synced?

This needs a bit support from the LDAP schema, as Proxmox VE cannot really tell else that you only want the user from a specific group.

I'd set a user filter like: memberOf=cn=MyGroup,ou=gon,dc=example,dc=com using the openLDAP memberOf overlay here works out quite nicely (albeit setting it up can have some pitfalls), but another attribute should also work out.

 

[twilcox]

Thanks for the reply. I'll try that out. How does syncing work before the version of proxmox that introduced syncing existed? The second box I'm working on is quite old and I need to add a group to that one as well

 

[t.lamprecht]

How does syncing work before the version of proxmox that introduced syncing existed?

Manually ;-) Then you had to manually create the user/group, PVE was then mostly just able to use LDAP for doing authentication checks.

The second box I'm working on is quite old and I need to add a group to that one as well

You probably want it to upgrade to 6.x, as older versions are end of life.

 

[twilcox]

Well I upgraded to version 6 to get the sync support and now I don't have the filter settings I would expect to see in the filter menu
I expect to see this:


And I got this

 

[t.lamprecht]

And I got this

As the yellow hint mentions, edit the realm for adapting the sync options like the user or group filter.

 

[twilcox]

I'd set a user filter like: memberOf=cn=MyGroup,ou=gon,dc=example,dc=com using the openLDAP memberOf overlay here works out quite nicely (albeit setting it up can have some pitfalls), but another attribute should also work out.

So is this supposed to be what I set my base_dn to?

 

[t.lamprecht]

No, I set it as user filter.

 

[twilcox]

I guess I'm not sure what to modify to get the user filter field to show up in the UI

 

[ademirk]

Hi,

so just to clarify, you want one group and all of its users to get synced?

This needs a bit support from the LDAP schema, as Proxmox VE cannot really tell else that you only want the user from a specific group.

I'd set a user filter like: memberOf=cn=MyGroup,ou=gon,dc=example,dc=com using the openLDAP memberOf overlay here works out quite nicely (albeit setting it up can have some pitfalls), but another attribute should also work out.

For my intended results I needed to add the memberof= query on users filter AND the (&(objectclass=group)(CN=Administradores)) on Group Filter.