Limit AD Read access to Business Unit

Question

Hi,

I have a Business Unit defined based on an LDAP Query which I use to limit the accounts in AD an admin can control. I would also like to limit the scope of the search so they can not find AD users outside of the BU.

I tried removing the Read All Objects from Domain User and adding Read All Objects to my admin role with an assignment over the BU, but now only the admin's own account is visible. I can only seem to get this to work by giving read to everything which isn't what I want?

I am assuming there is a set of attributes I need to allow access to for the LDAP filter to work on the BU, but having trouble working it out?

Thanks,

Comments

Hello,

Could you post here or send us to support[at]adaxes.com the following:

• A screenshot of Permissions and Assignments of your admin role.
• A screenshot of Membership Rules of the Business Unit.

---

Screenshots emailed as I couldn't get them here :(

---

Dazbo,

When you click Reply to Post, look right above the check boxes below the window for Options and find just to the right of it, in gray lettering, Upload Attachment

---

This is the Domain User Role and the Membership Rule.

The rule just has %extensionattribute5% in it and the admin users has and LDAP filter in this attribute to define the users they can control - i.e. (|(depertment=HR)(department=IT))

Setup like this it works, but the Admin can search for any user in the domain which is not what I want. If I remove the domain assignment from the Role then the admin can only find themselves.

Thanks

Answer 1

Hello,

The assignment of the Security Role is incorrect for the task you want to achieve. You included the Business Unit in the Assignments of the Security Role, and selected This object only as the assignment scope.

This means that you allowed authenticated users to view the Business Unit itself, but not the members of the Business unit. To allow users to also view members of the Business Unit:

1. Double-click the assignment of the Role that includes the Business Unit.
   
2. Select the Members of this Business Unit option.
   
3. Click OK.
4. Save the Security Role.

Comments

Now I fell dumb. I stared at this for ages and didn't spot that :(

Thanks again.