Skip to main content

Configuring External Role Mapping

Cassandra Seney
Updated

If you have a group of users in LDAP who need access to perform Repository Manager tasks, you can map those LDAP groups to repository manager roles. An External Role Mapping lets you grant repository manager privileges to an external LDAP group. 

Prerequisites

Before you begin, make sure LDAP Authentication is correctly configured. You should have already completed these steps:

  1. Configure Realms to add the LDAP Realm
  2. Create an LDAP Connection with user and group configuration

You can test the connection by clicking the Verify connection button on the LDAP configuration screen. To test the user and group settings you can use the Verify user mapping button.

You can also verify that the LDAP configuration is working correctly by searching for an LDAP user and making sure the LDAP groups for the user are displayed:

  1. In the Administration panel under Security select Users
  2. Change the Source to LDAP
  3. Search for an LDAP user ID
  4. Click on the user and make sure the External Roles are populated with LDAP groups to which the user belongs

If you do not see the groups listed you'll need to check the user and group configuration of the LDAP connection.

Create an LDAP External Role Mapping

Use the following steps to create a role mapping:

  1. In the Administration panel under Security select Roles
  2. Click the Create role button and select "External Role Mapping" and "LDAP" from drop-downs
  3. The Mapped Role drop down will be populated with the groups in your LDAP domain. Choose the group you wish to map.
  4. Provide a name for the role
  5. Assign roles and privileges
  6. Click Create role

More information about privileges can be obtained from help.

Troubleshooting

To obtain more information about the source of an LDAP related problem you can switch on LDAP debug logging. In the Administration panel under Support select Logging. Locate the logger org.sonatype.nexus.ldap and set the logging level to DEBUG.

These logs will contain more information about the cause of the problem. If you need to open a support ticket, it would help to enable LDAP logging and reproduce the problem before generating a support zip.

 

 

Related articles