Mapping External to Directory
If you're using Active Directory, do not use this method. Instead see the next section.
Suppose you want to have a role as an occupant of another role. For example, suppose there is a role called
bireporting and you wish for all the occupants of the
ceo role to also be occupants of the
bireporting role. One way to accomplish this would be to manually add all of the occupants of
ceo as occupants of the
bireporting role. Unfortunately, this solution does not reuse existing roles. Instead, you should be able to add the
ceo role as an occupant just as you would add a user as an occupant. Why would you need to do this? Because your Pentaho security configuration can simply reference the
bireporting role instead of a multitude of occupant roles.
The instructions below describe how to implement nested roles or groups by describing the nesting structure (the child to parent mapping) outside of the LDAP directory. Why would you want to describe the nesting (i.e. what role is an occupant of what other role) outside of the LDAP directory? Because it is potentially prohibitive to repeatedly query the directory to recursively find all parents of a given child role. So for performance reasons, the nesting is described outside of the LDAP directory.
Describing the Nesting
populator is no longer
DefaultLdapAuthoritiesPopulator. Instead, we've defined
NestedLdapAuthoritiesPopulator which subclasses
DefaultLdapAuthoritiesPopulator and adds a mapping for extra roles. In the
extraRolesMapping, the keys are child roles and the values are parent roles.
All Authorities Search
If the roles that serve as "parents" to nested roles cannot be returned by a traditional all authorities search, you'll need to add the parents to the list returned by your existing all authorities search using a transformer. The
ExtraRoles transformer handles this.
Nested groups in Active Directory
Microsoft Active Directory has a unique matching rule identifier (OIDs) that can be used to enable this quite easily. For more information, have a look here.
In the LDAP populator group filter, enter the following filter:
This will search down the whole tree of nested groups.