Active Directory for ACLs V1 - Lucidworks documentation

Compatible with Fusion version: 4.2.6 through 4.2.6

Use the Active Directory ACL Collection (V1)

The Active Directory Connector for ACLs indexes Access Control List (ACL) information into a configured “sidecar” Solr collection, so that it can be used by other connectors.

This article describes how to use an ACL collection generated by the Active Directory Connector for ACLs in V1 platform version.

During the security trimming stage, the ACL collection is queried using a Solr graph query, which creates a graph of the results using nodes from one document to another.To use the ACL collection, provide the inputs described below when configuring the Active Directory Connector for ACLs:

Input	Description	Example
Start Links	Each LDAP or LDAPS URL that is crawled.	`ldaps://na.lucidworks.com`
LDAP User Principal	The user principal account that crawls LDAP.	`firstname.lastname@na.lucidworks.com`
LDAP User Password	The password of the user that crawls LDAP.	`Password123`
LDAP Search Base	The base DN that performs the crawl.	`DC=na,DC=lucidworks,DC=com`
LDAP User Base (optional)	A list of users that are permitted to access a specific LDAP base.	`OU=Users,DC=na,DC=lucidworks,DC=com`
LDAP Group Base (optional)	A list of groups that are permitted to access a specific LDAP base.	`OU=Groups,DC=na,DC=lucidworks,DC=com`
LDAP User Filter (optional)	A custom attribute filter that finds user records in LDAP.	`(&(objectclass=user)(sAMAccountName=*))`
LDAP Group Filter (optional)	A custom attribute filter that finds group records in LDAP.	`(&(objectclass=group))`
SOLR ACL Collection Name	The name of the ACL collection.	`acl`
Index sAMAccountName Users (Active Directory only)	When active, a document is created in the ACL collection representing a user with an ID of `sAMAccountName`. This allows security trimming on the domain\username version of the username.	`true`
Index userPrincipalName Users (Active Directory only)	When active, a document is created in the ACL collection representing a user with an ID of `userPrincipalName`. This allows security trimming on the `username@fqdn.com` version of the username.	`false`

Learn more

Handle a Multi-Domain Active Directory

The Active Directory Connector for ACLs indexes Access Control List (ACL) information into a configured “sidecar” Solr collection, so that it can be used by other connectors.For applications involving multi-domain Active Directory, you need one LDAP data source per domain. Here is an example of a multi-domain Active Directory:

Domain	Type
lucidworks.com	parent domain
na.lucidworks.com	child domain
can.lucidworks.com	child domain
sa.lucidworks.com	child domain

In this example, you must have several data sources:

ldap://na.lucidworks.com
Base DN: DC=na,DC=lucidworks,DC=com

ldap://can.lucidworks.com
Base DN: DC=can,DC=lucidworks,DC=com

ldap://sa.lucidworks.com
Base DN: DC=sa,DC=lucidworks,DC=com

Please note that querying the Active Directory Global Catalog to have a single LDAP ACL datasource does not work, as the global catalog does not replicate the memberOf attribute of person objects. Doing so results in users not able to see the expected documents.However, you may be able to set up Active Directory to replicate that attribute. This would allow you to use a single global catalog for your entire Active Directory forest, if desired.

Configuration

When entering configuration values in the UI, use unescaped characters, such as \t for the tab character. When entering configuration values in the API, use escaped characters, such as \\t for the tab character.

AWS S3 V1 Alfresco V1

​Learn more

​Configuration

Learn more

Configuration