Netops Portal not Processing LDAP Groups Properly

Products

• CA Performance Management - Usage and Administration

Issue/Introduction

I have configured LDAP and users are able to successfully login to the platform. However I have attempted to configure LDAP so that only users within a specific AD group are able to gain access to the tool. 

Currently it appears that any user with a valid username/password are able to access the platform 

 

This is the config that we are using our goal is that only users in the following AD group - azgGNSAllUsers group would be able to access the platform . 

SSO Configuration/DX NetOps/LDAP Authentication:
Connection User: CN=xxx,OU=Service Accounts,OU=FISC,OU=SystemsCo,DC=DMN1,DC=FMR,DC=com
Connection Password: ***********
Search Domain: ldaps://xxx.xx.xxx:2489/ou=PeopleAuthSrch,dc=fmr,dc=com
Search String: (uid={0})
Search Scope: Subtree
User Bind: Enabled
Encryption: Simple
Account User: {uid}
Account User Default Clone: user
Group: <LDAPGroups><Group searchTag="memberOf" searchString="CN=azgGNSAllUsers,OU=AutoGroups,ou=PeopleAuthSrch,dc=fmr,DC=com" user="{uid}" passwd="" userClone="admin"/></LDAPGroups>
Krb5ConfigFile:
Status: Enabled
Timeout: 10000

 

Environment

Release : 21.2

Component : Performance Management Portal Web UI

Cause

Account User Default Clone: user

Resolution

In this instance change Account User Default Clone: user to Account User Default Clone: {uid} .... same as the 'Account User' setting

 

The ldapgroups only allows you to customize the incoming new user to be a different user to clone than the default.  If the user doesn't pass the ldapgroups, it uses the default user clone value.

 

The setting change should mean only users in ldap groups OR has an existing account can get in

 

So after making this change, if you delete the user from CAPC, and that user attempted to login, it should prevent the recreation of the user