1

I am able to get group of a user to which the user belong to. I can get this only if the user is assigned to one group. I am using the following search filter to get groups:

&(objectClass=groupOfNames)(member=cn=${username},ou=Users,dc=example,dc=com)

This filter works perfectly in openLDAP ldapsearch. But in Ping federate, it gives me null when I try to get more than 1 group for a user.

Please let me know if there is any other approach to achieve.

Thanks, Aswini J

1 Answer 1

2

Unfortunately this not possible using OpenLDAP because your filter is returning more than 1 object (multiple groups each with a unique DN). If you look at your OpenLDAP logs, it is most likely returning a "sizelimit exceed" message to PingFederate because PF is explicitly instructing the LDAP server to only return 1 object. This is a common issue when using PingFederate with Directories other than Active Directory and returning lists of groups. You can see more info here on this type of error -

https://ping.force.com/Support/PingIdentityArticle?id=kA340000000GsD6CAK

If OpenLDAP has the ability to manage Groups and Group Memberships in a similar fashion to AD, you should be able to return a list of Groups to PingFederate as you are trying to do.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.