How to configure multiple LDAP RBAC admin groups in Ops Manager

Products

• Operations Manager

Issue/Introduction

When configuring LDAP integration with Ops Manager, it's required to set LDAP RBAC Admin Group Name as shown in image below (more details available in the document). 

Currently only one group name can be set for this parameter. However, sometimes you might need to configure multiple LDAP groups for administrative purpose. This article shows how to configure multiple LDAP groups as LDAP RBAC Admin Group.

Environment

VMware Tanzu Operations Manager 

Cause

Only one group can be configured as LDAP RBAC Admin Group on Ops Manager web console.

Resolution

The solution is to utilise UAAC CLI command to map external group in LDAP to UAA scope opsman.admin, which will grant admin permission to external LDAP group.

1) Run uaac commands to target to Ops Manager UAA endpoint and get the token for admin user. Refer to the documentation for more details. If Ops Manager is already integrated with LDAP authentication, use command "uac token sso get" to get the token.

$ uaac token sso get opsman
Client secret:  ******
Passcode ( from https://opsmgr.example.com/uaa/passcode ):  

2) Run "uaac group mappings" to confirm the LDAP group configured in "LDAP RBAC Admin Group" box in Ops Manager is already mapped to ospman.admin scope for ldap origin. For example,

$ uaac group mappings
  resources
    ldap: 
    -
      uaa.admin: cn=group1,ou=groups,dc=example,dc=com
    -
      opsman.admin: cn=group1,ou=groups,dc=example,dc=com

3) Run "uaac group map" command to map other LDAP group to ospman.admin scope for ldap origin

$ uaac group map "cn=group2,ou=groups,dc=example,dc=com" --name opsman.admin --origin ldap

4) Confirm the group mapping is performed successfully

$ uaac group mappings
  resources
    ldap: 
    -
      uaa.admin: cn=group1,ou=groups,dc=example,dc=com
    -
      opsman.admin: cn=group1,ou=groups,dc=example,dc=com

    -
      opsman.admin: cn=group2,ou=groups,dc=example,dc=com

 

5) Try to login Ops Manager web console with some LDAP user in the newly mapped group

 

Notes: the group mappings made with this approach will be gone if any of the following changes occurs

1) Any change is made and applied to LDAP Settings in Ops Manager web console

2) The Ops Manager authentication method is changed from LDAP to something else (e.g. SAML) and later back to LDAP

The group mapping need to be redone after any change mentioned above is made.

Additional Information

Configuring LDAP integration with VMware Tanzu Application Service (TAS) for VMs