|
Indicates the filter used to locate the user's authorization profile in the LDAP directory.
This class must be used when profileFilter in Ldap MO is set to FLEXIBLE.
Example of use with POSIX group objects as authorization profile:
The user authorization profile is mapped to posixGroups in the LDAP schema. Each posixGroup contains a set of users and by this association, users are mapped into one or more groups. To identify the set of groups a user is a member of, the following search filter must be used:
(&(objectClass=posixGroup)(memberUid=%u)) cn
where %u is the user ID parameter used during authentication and cn is the common name value returned for the posixGroup. This must match an authorization entity, for example role, in an authorization method. (&(objectClass=posixGroup)(memberUid="")) is the search filter contained by the filter attribute.
This MO is created by the system.
|