Is it possible with LDAP?

[quasar]

I've got this LDAP stucture:

dc=century,dc=local
                           |__ou=group
                                             |__cn=alfresco
                           |__ou=people
                                              |__uid=user1
                                              |__uid=user2
                                              |__uid=user3
‍‍‍‍‍‍‍‍‍

cn=alfresco is:
dn: cn=alfresco,ou=group,dc=century,dc=local
objectClass: posixGroup
objectClass: top
cn: alfresco
gidNumber: 1
memberUid: user1
memberUid: user2

As you can see from this description user1 and user2 are both members of the alfresco group.
I want users from the alfresco group can access the system and I don't want to synchronize groups in alfresco and groups in LDAP but only users.
What are config options for my case?
Thanks a lot!

[durrell]

It's possible.

You need to set your search base to search all users in the AD. Example: OU=people,dc=century,dc=local

Then, you need to set your personQuery to query only those who are members of that group based on CN=Alfresco. Example: (memberOf=CN=alfresco,OU=Group,DC=century,DC=local)

That should work. I tested it on my AD and it returned all members of the group I tested. Let me know if it does.

[quasar]

Thanks for reply, durrell!
I think my problem is the search query actually.
I'm unable to construct the query to find all users from OU=people,dc=century,dc=local witn memberUid: user1
memberUid: user2 from cn=alfresco,ou=group,dc=century,dc=local.
I'm using OpenLDAP not AD.
Could you help me with it?

[durrell]

I'm not quite sure what you're asking. How many users are you trying to pull into Alfresco? I am not very familiar with OpenLDAP, actually.

[dward]

In OpenLDAP you need something called Reverse Group Membership Maintenance to be able to query a user's group memberships. See http://www.openldap.org/doc/admin24/overlays.html#Reverse%20Group%20Membership%20Maintenance. Rather than requiring all users to be in a certain group, it's more common for them to just be in a certain sub-tree of the LDAP server, in which case you could just configure userSearchBase to use the correct DN prefix.