Map your Active Directory or LDAP groups in Bonita Open Solution 5

Issue:
You have your users and groups defined in an Active Directory or a LDAP server and you want to use them in Bonita Open Solution in order to assign tasks.
Solution:
To do that, you have to use the LDAP group resolver or the Active Directory group resolver to do a one-to-one group mapping in Bonita Open Solution.
This article explains how to do that step by step.

Prerequisite

You need to know how your directory is structured. Generally, when you create users and groups in a directory, you are invited to create one container for users and another one for groups. So the first thing you need to know is the paths to these 2 containers.
For this article I suggest the next structure (adapt this guide with your own structure):

DC=ad,DC=bonitasoft,DC=com
|
+– OU=BOSGroups,DC=ad,DC=bonitasoft,DC=com
|    |
|    +– CN=bos5test1,OU=BOSGroups,DC=ad,DC=bonitasoft,DC=com
|    +– CN=bos5test2,OU=BOSGroups,DC=ad,DC=bonitasoft,DC=com
|
+– OU=BOSUsers,DC=ad,DC=bonitasoft,DC=com
|
+– CN=rodrigue,OU=BOSUsers,DC=ad,DC=bonitasoft,DC=com
+– CN=miguel,OU=BOSUsers,DC=ad,DC=bonitasoft,DC=com

rodrigue, miguel are in bos5test1 and rodrigue is in bos5test2.

What are we going to do?

The goal here is to create 2 groups in Bonita Open Solution according to this mapping:

BOS Group	LDAP/AD Group
Group Test 1	CN=bos5test1
Group Test 2	CN=bos5test1

How to do that?

You have to use a group resolver which is a specific connector to create a group. In Bonita Open Solution, a group is a way to represent a list of candidates. You have to translate the group in a list of users with a group resolver. In our case, you will use either the LDAP group resolver (if you reach a LDAP server) or the ADGroupResolver group resolver (if you reach an AD server -  note that you need to install this connector from the community contributions). These 2 connectors work in the same way. So you need to configure:

1. the server access
2. the query to find your list of usersT
3. To write your query you need to provide:
   • the path to where your groups are stored. In the given example: OU=BOSGroups,DC=ad,DC=bonitasoft,DC=com
   • the path to where your users are stored. In the given example: OU=BOSUsers,DC=ad,DC=bonitasoft,DC=com
   • the filter to find the group: example: CN=bos5test1
     Warning, the filter is applied on the groups not on the users.

Configuration and test of a group mapped with Active Directory: step by step

1. Open menu Connectors > Test a Connector
   
2. Select Group and click on Next
   
3. Select the ADGroupResolver connector and click on Next
   
4. Select configure from blank and click on Next
   
5. Fill the form to connect to the Active Directory server (note the port is 389) and click on Next
   
6. Fill the request with the group base path, the user base path and the filter (here CN=bos5test1)
   
7. Click on Evaluate and check that your configuration is ok
   
8. Save your configuration: click on save connector configuration, enter the name of your configuration and click on Finish
   
9. Click on Close
10. Create a new process, select Step1 and select Actors tab
    
11. Click on Create
12. Select the ADGroupResolver connector and click on Next
    
13. Enter the name of the group in Bonita Open Solution: Group Test 1, and click on Next
    
14. Select Configure connector starting from an existing configuration and select the saved configuration: Configuration for Group Test 1 and click on Next
    
15. Click on Finish
16. Select your process and select the Dependencies tab
    
17. Add the ldap connector in the dependencies
    

We’ve successfuly configured and tested the group. You are now able to run your application and see that your task is assigned to admin (the Initiator group), rodrigue and miguel.

What have you learned?

You’ve learned how to map a Bonita Group with an AD or LDAP group

What haven’t you learned?

You haven’t learned to do an authentication against LDAP or AD server. This is not done with Bonita Open Solution but it will depend on your deployment server (Tomcat, JBoss, JOnAS, Glassfish, …). You can configure the authentication with LDAP or AD server by configuring the JAAS layer of your server. Please refer to your Application Server Documentation to know how to do that.
Your comments are welcome in order to improve this article.