User permission and attribute synchronization

Synchronize user permissions, group membership, and attributes from Active Directory into Cloud Management Platform (CMP), so you can manage them in your directory instead of the UI

  3 minute read  

How it works

When an external user (one authenticated against an external source) logs in, CMP runs every action enabled for the External Users Sync trigger point. These actions fetch the user’s permissions and attributes from an external system such as Active Directory, then add or remove the user from the appropriate groups and roles. This runs synchronously: the user cannot use the UI until it completes.

Use the User Permission Sync From LDAP action

CMP includes a sync action, enabled by default, that grants a user roles based on their LDAP OU and group membership. For each LDAP utility you create, map its OUs and groups to the equivalent groups and roles.

To set up the sync, create one or more mappings:

  1. Go to Admin > LDAP Authentication Settings and select your LDAP utility.
  2. On the Group Mappings tab, select New LDAP Mapping. In the dialog, provide the LDAP OU and group the user must match to receive roles, using the full distinguished name (found in the object’s properties in Active Directory). If the mapping grants global or admin roles, set those here too.
  3. On your new mapping, select Add Group Roles, then select a group and the roles to grant in it. This link does not appear for Super Admin mappings.
  4. To test, select Sync Mappings and run a dry run against a user to preview the roles they would receive.

Mappings are additive: a user affected by more than one mapping receives all the roles from each.

For Active Directory, the user’s primary group is not used when applying mappings.

Synchronize user attributes from LDAP

CMP can also synchronize user attributes. To set this up:

  1. Go to Admin > LDAP Authentication Settings, select your LDAP utility, and open the Attribute Mappings tab.
  2. Select New LDAP Mapping to map an LDAP attribute to a parameter.
  3. Provide the External attribute name, select a Parameter, and select Save.
  4. To test, select Sync Mappings and run a dry run against a user to preview the parameter values that would be added to their profile.

Parameters with “show on objects” set to true appear on the user’s details page.

Once parameters are set on users, you can use them in actions. Try CMP’s built-in plugin that uses parameters at Admin > Orchestration Actions > Provision Server > Pre-Provision > Sample Per-User Server Limits Action.

To cap how many servers a user can own using an LDAP attribute:

  1. Enable the Sample Per-User Server Limits action.
  2. Create a custom field of type Integer called max_servers, with “show on objects” set to true.
  3. Create the attribute in LDAP on each user who should have a non-default server limit.
  4. Create a mapping from the LDAP attribute to the max_servers parameter.
  5. Select Sync Mappings, then open the user’s details page to confirm the parameter is set.
  6. In LDAP, set the user’s limit to the number of servers they already own, then log in as that user and try to provision a server. The action causes the provisioning job to fail before it takes any action.

This is just one use. You can copy any LDAP data to user profiles and then use it programmatically.

Create custom actions

Manage the external user sync actions at Admin > Orchestration Actions > Other > External Users Sync. Use the default action as a sample for your own; if you modify it, duplicate it first and edit the copy.

For more examples, see the CloudBolt Forge.

Test it

Go to Admin > Users, select an external user to test, and select Sync External User.

To sync all users who have logged in, use the Group Mappings tab in your LDAP utility. This can take a long time for many users.