# LDAP Organization Mapping

**URL:** <https://forum.ansible.com/t/ldap-organization-mapping/33288>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [June 30, 2020, 5:14pm UTC](https://forum.ansible.com/t/ldap-organization-mapping/33288 "2020-06-30T17:14:59Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alex\_Trifonov](https://avatars.discourse-cdn.com/v4/letter/a/87869e/32.png) [@Alex\_Trifonov](https://forum.ansible.com/u/Alex_Trifonov)\
**Post date:** [June 30, 2020, 5:14pm UTC](https://forum.ansible.com/t/ldap-organization-mapping/33288/1 "2020-06-30T17:14:59Z")

</div>

Hello,

I’m configuring LDAP authorization at the AWX (9.2.0) .  
Authorization passes, but mapping users to organizations based on LDAP groups does not work.

When authorizing an LDAP user sn.ivanov, the following is written in the logs:

`  
2020-06-30 15:22:13,581 DEBUG django\_auth\_ldap search\_s(‘OU=MIQ,DC=BANK,DC=RUS,DC=CONTOSO’, 2, ‘(sAMAccountName=%(user)s)’) returned 1 objects: cn=ivanov sergey,ou=miq,dc=bank,dc=rus,dc=contoso  
2020-06-30 15:22:13,585 DEBUG django\_auth\_ldap Populating Django user sn.ivanov  
2020-06-30 15:22:13,587 ERROR django\_auth\_ldap search\_s(‘OU=MIQ,DC=STS,DC=RUS,DC=CONTOSO’, 2, ‘(&(objectClass=group)(member=cn=ivanov sergey,ou=miq,dc=bank,dc=rus,dc=contoso))’) raised REFERRAL({‘desc’: ‘Referral’, ‘info’: ‘Referral:\nldap://sts.rus.contoso/OU=MIQ,DC=STS,DC=RUS,DC=CONTOSO’},)  
2020-06-30 15:22:13,587 DEBUG django\_auth\_ldap search\_s(‘OU=MIQ,DC=STS,DC=RUS,DC=CONTOSO’, 2, ‘(&(objectClass=group)(member=cn=ivanov sergey,ou=miq,dc=bank,dc=rus,dc=contoso))’) returned 0 objects:  
2020-06-30 15:22:13,595 DEBUG django\_auth\_ldap cn=ivanov sergey,ou=miq,dc=bank,dc=rus,dc=contoso is not a member of cn=miq\_admins,ou=miq,dc=sts,dc=rus,dc=contoso  
2020-06-30 15:22:13,595 DEBUG django\_auth\_ldap cn=ivanov sergey,ou=miq,dc=bank,dc=rus,dc=contoso is not a member of ou=miq,dc=bank,dc=rus,dc=contoso  
2020-06-30 15:22:13,634 INFO awx.api.generics User sn.ivanov logged in from 10.31.252.123

`

The user sn.ivanov@BANK.RUS.CONTOSO is precisely a member of the group CN=MIQ\_admins,OU=MIQ,DC=STS,DC=RUS,DC=CONTOSO

Here is /etc/krb5.conf:

`  
includedir /etc/krb5.conf.d/

[logging]  
default = FILE:/var/log/krb5libs.log  
kdc = FILE:/var/log/krb5kdc.log  
admin\_server = FILE:/var/log/kadmind.log

[libdefaults]  
dns\_lookup\_realm = false  
ticket\_lifetime = 24h  
renew\_lifetime = 7d  
forwardable = true  
rdns = false  
pkinit\_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt  
spake\_preauth\_groups = edwards25519  
default\_realm = STS.RUS.CONTOSO  
default\_ccache\_name = KEYRING:persistent:%{uid}

[realms]  
RUS.CONTOSO = {  
kdc = RB-ADC-F1D1-1.RUS.CONTOSO  
admin\_server = RB-ADC-F1D1-1.RUS.CONTOSO  
}  
STS.RUS.CONTOSO = {  
kdc = RB-ADC-F1D3-1.STS.RUS.CONTOSO  
admin\_server = RB-ADC-F1D3-1.STS.RUS.CONTOSO  
}  
BANK.RUS.CONTOSO = {  
kdc = RB-ADC-F1D2-1.BANK.RUS.CONTOSO  
admin\_server = RB-ADC-F1D2-1.BANK.RUS.CONTOSO  
}

[domain\_realm]  
rus.contoso = RUS.CONTOSO  
.rus.contoso = RUS.CONTOSO  
sts.rus.contoso = STS.RUS.CONTOSO  
.sts.rus.contoso = STS.RUS.CONTOSO  
bank.rus.contoso = BANK.RUS.CONTOSO  
.bank.rus.contoso = BANK.RUS.CONTOSO  
`

The following is specified in the “LDAP Organization Map” authorization settings:

`{ "Default": { "remove_admins": false, "admins": ["CN=MIQ_admins,OU=MIQ,DC=STS,DC=RUS,DC=CONTOSO", "OU=MIQ,DC=BANK,DC=RUS,DC=CONTOSO"], "remove_users": false, "users": false } }`

May be you can help me with it?