Restricting Login Access by Group Membership Instead of a User Attribute in Administrative UI (AdminUI)
Article ID: 446769
Updated On:
Products
Issue/Introduction
When running the Administrative UI (AdminUI), is the authentication can be restricted based on a specific attribute or on group membership to access it?
Resolution
The "Configure Administrative Authentication" wizard is used to set where and how administrator users are found.
Out of the box, only the User ID is used to find a user. The User ID is mapped to a unique attribute in the LDAP administrator store.
There is no way to combine that User ID with another attribute — for example, requiring a user with "User ID: <admin>" AND "businessCategory: <category>" to be able to log in. Authentication is based on the User ID alone.
The other attributes and the group description are only used to help locate users when adding an administrator on the Administration > Administrator > Administrators page, which provides a "User Lookup" and a "Group Lookup" button.
The "Group Lookup" button lets you search by group name. Once a group is selected, all of its members become able to log in as administrators with the privileges selected on that same page.
So instead of relying on a "businessCategory: <category>" attribute on the users, create a group called "<category>", make the relevant users members of that group, and add that group as an Administrator (1)(2)(3)(4).
Note that the Super Admin can always log in, even if not a member of the group, because the Super Admin account exists to guarantee that the AdminUI and full configuration remain accessible to at least one user. So, if certain super users should not be allowed to log in, remove their super-user privileges.
Having configured:
Enter Directory Layout Information
Group Subtree : ou=<organizationalunit>, o=<organization> ...Group Class : groupOfUniqueNamesGroup Lookup : (&(objectclass=groupOfUniqueNames)(cn=<admin>))Get User Groups : (&(objectclass=groupOfUniqueNames)(uniqueMember=%USER_DN%))
The place to configure which users can actually log in is not this pane, but rather:
Administration / Administrator / Administrators
On that page, add the required group to grant access to the AdminUI, along with the specific permissions that should apply to those users.
The "Enter Directory Layout Information" pane only configures the search used by the "Group Lookup" (and "User Lookup") buttons on the Administration > Administrator > Administrators page — it does not, by itself, grant or restrict login access.
Additional note: When the AdminUI is protected by CA Access Gateway (SPS), authentication error messages can be redirected to a custom page.
Additional Information
Feedback
