Not authorized because not authenticated

[ramidr]

I want that only shop administrators can login

In my devise.rb:

config.ldap_check_group_membership = true

And in my ldap.yml

authorizations: &AUTHORIZATIONS
  group_base: CN=Users,DC=LDAPTEST,DC=local
  ## Requires config.ldap_check_group_membership in devise.rb be true
  # Can have multiple values, must match all to be authorized
  required_groups:
    # If only a group name is given, membership will be checked against "uniqueMember"
    - CN=ShopAdministrators,CN=Users,DC=LDAPTEST,DC=local

But the rails log say me:

  [1m[36mUser Load (1.0ms)[0m  [1mEXEC sp_executesql N'SELECT TOP (1) [users].* FROM [users] WHERE [users].[login] = N''peter.anguille'''[0m
  [36mLDAP:[0m LDAP dn lookup: sAMAccountName=peter.anguille
  [36mLDAP:[0m LDAP search for login: sAMAccountName=peter.anguille
  [36mLDAP:[0m LDAP search yielded 1 matches
  [36mLDAP:[0m Authorizing user CN=David Ramírez,CN=Users,DC=LDAPTEST,DC=local
  [36mLDAP:[0m LDAP dn lookup: sAMAccountName=peter.anguille
  [36mLDAP:[0m LDAP search for login: sAMAccountName=peter.anguille
  [36mLDAP:[0m LDAP search yielded 1 matches
  [36mLDAP:[0m Not authorized because not in required groups.

With a LDAP explorer I check that this user is memberOf that group.

Other possible way, the same:

# If an array is given, the first element will be the attribute to check against, the second the group name
    - ["memberOf", "CN=ShopAdministrators,CN=Users,DC=LDAPTEST,DC=local"]

I try with this configuration too:

config.ldap_check_attributes = true

and in ldap.yml:

require_attribute:
   memberOf: CN=ShopAdministrators,CN=Users,DC=LDAPTEST,DC=local

Any ideas?

[ggnix]

Hello, ramidr! I actually have the same issue, did you resolve it??

[PritiKumr]

Hi ramidr and gleb93, moved into the same issue. Have any suggestions you could offer me?

[dougfarre]

+1 Can't figure this out!!

[gmaxwell94]

devise will use the database to authorize. So you need to have added the ldap user to the database allowing a token (in database) to be made for that user. In config/initializers/device.rb make sure
config.ldap_create_user = true default is false

[b1nary]

I am stuck at the same issue. Not sure how the suggestion my gmaxwell would look in code form

[iamtarun]

Hello,

I facing same issue.

[a2f0]

+1

[pka23]

Have you uncommented lines?

<<: *AUTHORIZATIONS

in your Environment sections of ldap.yml

[hexenus]

devise.rb config.ldap_check_group_membership = true config.ldap_ad_group_check = true #both of them should be TRUE, otherwise it is not working

ldap.yml #group_base: should be like group_base: ou=groups,dc=test,dc=com required_groups: - cn=users,ou=groups,dc=test,dc=com <<: *AUTHORIZATIONS #should be uncomented