LDAP User Groups, Roles and Auditing - identifying what roles a user has because of which groups
Hello,
Some users have been reporting that after using the system for a while, they will log in and their roles will be unassigned and they can't view anything, at which point we'll manually go in at resolve them. As part of trying to identify a pattern I have been requested to Audit the users that are in the CSS and possibly remove those that haven't accessed the system in X amount of time. As part of that and in trying to identify a pattern in the users encountering that problem I'm checking that what roles/groups users are assigned to ensure that it's correct.
Is there any way to get this information from the CSS? Given that there are both Local and LDAP groups in use, I cannot view which users are in LDAP groups without individually opening each user and viewing their roles/groups. The information CSS gets from LDAP doesn't appear to be stored in the database so it'd not accessible from there.
In Brief: I need is a list of users, their username, which groups their assigned to, and which roles they're assigned either by proxy of being in a group with that access or that they are assigned that role individually.
Has anyone found a way to perform this sort of task or is it a possible enhancement request?
Footnote: CSS version is 12.2.1
UPDATE:
I have discovered that accessing the list of users from CAS gives me the list of users and their groups, including their LDAP groups. It does not provide the other information required but the information there can be matched to information from the CSS and then the groups looked up for what roles they provide.
I would still like a list of the roles that a user has so I can match it to the roles that are provided via their group, but it's something.
Hi April
I don't have a active LDAP connection in my sandbox but there is a log file in \Common Components\cc\eclipse\workspace\logs that tells about the activity.
It might give you some insight as to why some of your users fail to authenticate unless you guys go and kick the box.
Thank Ulf, I will look into that.
The users don't "fail" so much as one day they log in and all their roles and groups have been removed.
