LDAP Filter help needed

Question

Hello,

I search an ldap filter to allow me to show managed user and user managed by the managed user (dunno if i'm clear).

Let me give an exemple.

Pierre is the manager of Richard
George is the manager of Richard.

If george use my action pannel, i want him to be able to apply those modification on Richard and Pierre. Actually i am only able to show Pierre. Here is the LDAP filter for that : (manager=%distinguishedName%)

I tried this filter but it's not working :

(|(manager=%distinguishedName%)(manager=$((manager=%distinguishedName%).distinguishedname)))
(|(manager=%distinguishedName%)(manager=$(manager=%distinguishedName%))

Answer 1

Hello Alexandre,

You won't be able to build such a filter only using value references. You'll need a script for that.

In our script repository, you can find a script that builds a filter to find all subordinates of a user. See Create LDAP filter to find all subordinates of user. Using the script, you can create a Scheduled Task that updates the filter for all managers in your AD on a certain schedule.

The script saves the filter to a certain attribute of the manager identified in the script by the propertyForFilter variable. In the parameters of your action, you can use a value reference for this attribute to insert the generated LDAP filter. Thus, for example, if you specified adm-CustomAttributeText1 in propertyForFilter, then in the parameters of your action you need to specify %adm-CustomAttributeText1%.

Comments

Perfect, this is indeed working using the Scheduled task.

Is there a security rule to apply to those kind of "super manager" to allow them to edit any user managed by them ?

---

Hello,

Yes, there is. First of all, you need to create a Business Unit that will include, for each manager, all objects managed by them. Then, you need to assign a Security Role to the managers including the Business Unit in the Activity Scope.

I. Create Business Unit that includes all objects managed by a user

For information on how to create a Business Unit that includes all objects managed by a user, see see Example 3 under Query Results in the following tutorial: http://www.adaxes.com/tutorials_ActiveD ... InUser.htm. In the LDAP Filter field, you need to specify a value reference for the property you used in your script. For example, if you specified adm-CustomAttributeText1 in propertyForFilter, then you need to specify %adm-CustomAttributeText1%.

II. Assign the Security Role
To grant the managers permissions for their subordinates, you need to assign them a Security Role that grants sufficient permissions and include the Business Unit you created on step I in the Assignment Scope. For example, you can use one of the built-in roles for this purpose, such as Account Manager or Super Manager, or create your own Security Role for this purpose.

To assign an existing role:

1. Locate and select the role you need in the Console Tree.
2. Right-click in the Assignments section and select Add Assignment.
   
3. If you want to grant the permissions to all managers, select Authenticated Users.
   *- or -*
   If you want to grant the permissions to a specific user or group, select it in the list.
   
4. Click OK.
5. In the Specify Activity Scope dialog that opens, select the Business Units item in the Look in drop-down list.
6. Select the Business Unit you created on step I.
   
7. Click Add, then click OK 2 times.
8. Save the changes.