DESCRIPTION:
When Lightweight Directory Access Protocol (LDAP) users are imported, they are not shown as being members of their defined Strategy user group. However, these users are linked to their respective groups and receive the privileges, security roles and security filters assigned to the group by the administrator.
For example, User1 belongs to TechSupport LDAP group as shown below:
However, this group is not checked when editing the user:
This behavior is by design. It is assumed that users and groups imported from an LDAP server derive their group membership from the LDAP server, not from the Strategy metadata. Every time a user logs in, his or her current group memberships are checked in the LDAP server and the current user session is created with those group memberships. This behaviour is detailed in the technical note:
It is always possible to assign group membership manually in the user editor. Memberships saved into the metadata in this way always exist and will always apply to user sessions, whether or not they are still valid according to the LDAP server. If the user is removed from a group in the LDAP server, this will not automatically remove the group membership from the metadata. Therefore, in environments where security is configured through the LDAP server, it is important for Strategy not to retain group membership information in the metadata.
EXAMPLE:
If an LDAP user who belongs to GROUP1 and GROUP2 logs in, this user will belong to GROUP1 and GROUP2 in Strategy. However, if the user changes to GROUP3 and GROUP4 on the LDAP Server only, Strategy will still associates the user with GROUP1 and GROUP2.
If the administrator has not unchecked GROUP1 and GROUP2 from this user, the next time they log in, the user will belong to GROUP1 and GROUP2, in addition to GROUP3 and GROUP4. Since the boxes aren't checked, this is verified internally.
