Uploaded image for project: 'Documentation'
  1. Documentation
  2. DOCS-13199

Suggestions for additional notes on Ops Manager LDAP

    • Type: Icon: Task Task
    • Resolution: Unresolved
    • Priority: Icon: Major - P3 Major - P3
    • None
    • Affects Version/s: None
    • Component/s: Ops Manager
    • Labels:

      Suggestions for additional notes on https://docs.opsmanager.mongodb.com/current/tutorial/configure-for-ldap-authentication/#associate-ldap-groups-with-project-roles and https://docs.opsmanager.mongodb.com/current/reference/api/groups/map-ldap-groups-to-manager-roles/

      Customers have been unclear about how to add a user to a group/project with certain roles using the Ops Manager API.

      We might want to include notes mentioning that:
      1. Once Ops Manager has been configured to use LDAP for access to the web UI no other authentication mechanisms will be used. This means that no users will be added or modified in the backing databases, which is what the API provides access to. To add new users to Ops Manager, you would need to add them to the LDAP directory used by your organization and ensure they are members of LDAP groups that map to roles in your Ops Manager deployment.
      Again - no user management happens in Ops Manager, all such activity is delegated to the LDAP server.

      2. For security reasons, it is not possible to add users to your LDAP server using Ops Manager.

      3. All user management (which user participates in which group(s)) is done in LDAP.
      LDAP in Ops Manger will require Group DN assignments.

      4. You can use the API to manage the relationship in Ops Manager. eg: Which LDAP group(s) correspond to which Ops Manager roles in a particular OM project

      5. If using LDAP, you would create one or many LDAP groups containing Users. Example `OM_RO_MyProject`
      You would then use the API (or the UI) to Map LDAP Groups to Ops Manager Roles giving the Users in that LDAP Group the desired Project Role.

      6. If the requirement is to have a single read-only group across multiple projects - you would use API calls to associate that LDAP group with the Role (example: GROUP_READ_ONLY) for the required Ops Manager projects.
      If the requirement is to have a different read-only group assigned to individual projects - you would use API calls to associate that LDAP group with the Role (example: GROUP_READ_ONLY) to the specific project.

            Assignee:
            Unassigned Unassigned
            Reporter:
            charles.merrill@mongodb.com Charles Merrill
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              4 years, 25 weeks, 3 days ago