New Xton Documentation Center
Xton help has moved. Please visit the current version of this page for the most recent updates. Our new documentation center can be found at help.xtontech.com.
How to restrict AD user and group lookup using an LDAP filter
The objective is to restrict XTAM logins to a specific security group and on an object’s Grant Access (permissions) dialog only the authorized users should be shown up in the lookup.
The LDAP query is located in the file $XTAM/web/conf/catalina.properties and the property is ldap.authn.searchFilter which is an AD / LDAP query to limit users for login (for basic authentication) and user lookups. This property uses {0} as a placeholder for an account. If you use the Federated Sign-In module, then the property to restrict login is cas.authn.ldap[1].userFilter with the account placeholder {user}.
The default value for ldap.authn.searchFilter is sAMAccountName={0}. To switch to UPN authentication you can use UserPrincipalName={0}. Below is the example of more complex filter to limit user base to an AD group:
(&(UserPrincipalName={0})(memberOf=CN=Group,OU=Users,DC=company,DC=com))
Another popular way is to keep the search property as is, but instead to modify the branch entry into the AD forest using these parameters below. This method is a quick way to limit the user base to some OU. Both methods could be used together.
ldap.rootDn ldap.baseDn ldap.roleBase cas.authn.ldap[1].baseDn