Multiple user directories using delegated LDAP authentication with Active Directory

Question

We are trying to set up three user directories in Crucible, using delegated LDAP authentication.  Each one uses Microsoft Active Directory, but they are different LDAP servers (the LDAP URLs are different). Each one has "Copy user on login" set to true. I have two questions:

* If all three user directories are active, what happens when a new user logs in? Which directory does he get assigned to? Does Crucible search all three and look for a match?
* Under this configuration, how would I create a user in the internal directory (like a generic admin user)? Does that directory have to be first in the list of user directories?  If I did that, wouldn't all new user logins then be created in the internal directory?

GLENN MAYER · Answer

Any update on this?  Adding users to the internal directory seems to require that the directory be moved to the top of the list....

GLENN MAYER · Answer

Thanks Benjamin.  Adding the Admin-User actually did not work the way you explained. When LDAP-1 was the first listed, and I added a generic user, it got added to the LDAP-1 group (I verified this by looking directly at the database; I don't know how to check it any other way).  However, once added, I was not able to login with it.  When I tried to reset the password, Crucible said it was not editable because it was in an LDAP group.  To add this user to the internal directory, I had to delete the one I had added to LDAP-1, move the internal directory to the first position, add the Admin-User, and then move the internal directory back down to after the LDAP directories.

This is Crucible 4.1.1.

Benjamin Weinheimer-Erben _mgm-tp_ · Answer

Hi Glenn,

the user will be assigned to the first directory he is in. As example: User-A is in LDAP-1 and LDAP-3, User-B is in LDAP-2, the three LDAPs have the order 1-2-3 from the top down.

--> User-A will be mapped to LDAP-1 and his account in LDAP-3 will not be used somehow

--> User-B will be mapped to LDAP-2

If you give the Admin-User a name which does not appear in any of your LDAPs, it is not important if the internal directory is first or last.

hope that helps - greetings
Benjamin