Recursive AD Synchronisation with Sitecore Active Directory Module

Sitecore's Active Directory connector provides functionality to allow users to perform Single Sign-on to the Sitecore client transparently using their Active Directory accounts.  It is easy for content authors to use, all they need to do is point their browser at the following URL on their Sitecore content management server:

/sitecore/admin/ldaplogin.aspx

However users can only login to Sitecore in this way if they have been synchronised using the Active Directory connector configuration.  All the gory details of setting up Sitecore configuration can be found in the module's Administration Guide, but the two that I want to talk about in this post are the LDAP connection string, and custom filters.  Together these settings control which groups (roles) and users are synchronised from AD into Sitecore.

LDAP Connection String

The LDAP connection string is configured in the Sitecore ConnectionString.config file, it provides the details for connecting to Active Directory including the server name and location in the AD tree to connect.

<connectionStrings>
 <add name="ManagersConnString"
 connectionString="LDAP://ADServer:389/OU=Corporate,DC=MyCompany,DC=local" />
</connectionStrings>

This setting is reasonably straight forward, but make sure that the OU you connect to is high enough in the AD structure to contain all the groups and users that you want to synchronise.

Custom Filters

If you simply provide an LDAP connection string, all the groups and users within the org unit that you specify will be synchronised into Sitecore.  Depending on the AD structure this could be hundreds (or more) or groups and users.  At the very least this makes using the Sitecore user and role manager tools extremely painful!

To only synchronise a subset of users and groups, customFilters can be specified in the membership and role provider configurations.  This customFilter is specified in LDAP query syntax.  The Admin Guide gives the following example of a customFilter that will synchronise only a group and all its users into Sitecore.

customFilter=”(memberOf=CN=testgroup,OU=Groups,DC=devtest,DC=sitecore,DC=net)”

The customFilter used in both the membership and role providers must be the same.

Supporting multiple roles and their users

In my experience, the need in an enterprise installation of Sitecore is to import a number of roles with all the users contained in one or more of them.  Even in the simplest of cases there is a content author role and a content approver role, and depending on the governance structures in place there can also be other roles required such as legal review which either have access to specific workflow states and actions, or to content is specific parts of a site.  To support this more advanced requirement, I follow the following pattern:

• Have an AD group for each of the Sitecore roles being mapped (the users for each role are managed by placing them in the appropriate group in AD)
• Create a "Sitecore Groups" group in AD 

At this point, you will have a structure in AD that looks something like this, where you want all the groups under Sitecore Groups to be mapped into Sitecore as roles, and all the users in those groups to be mapped as Sitecore users.

• Specify a custom filter for both the membership and role providers using LDAP_MATCHING_RULE_IN_CHAIN syntax

The LDAP_MATCHING_RULE_IN_CHAIN syntax is a magical operator that you can insert into your LDAP query.  I say magical because it is a great example of the hated magic number!  Here is an example of this syntax:

(memberOf:1.2.840.113556.1.4.1941:=CN=Sitecore Groups,OU=Corporate,DC=MyCompany,DC=local)

The  :1.2.840.113556.1.4.1941: is that magic number for LDAP_MATCHING_RULE_IN_CHAIN, and instructs the LDAP query to recurse through the tree of groups/users under the targeted group and match everything that it finds.  

This will synchronize all the groups (in the case of the roles provider) and users (in the case of the membership provider) in the Sitecore Groups group and all sub-groups beneath it.  If you open the Sitecore user and role managers you should now see only these roles and users in the Sitecore mapped "ad" domain.