# Condition OR for LDAP in group

**URL:** <https://forum.opennebula.io/t/condition-or-for-ldap-in-group/10033>\
**Category:** Product Support\
**Created:** [October 15, 2021, 9:29am UTC](https://forum.opennebula.io/t/condition-or-for-ldap-in-group/10033 "2021-10-15T09:29:51Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![perrfect](https://avatars.discourse-cdn.com/v4/letter/p/45deac/32.png) [@perrfect](https://forum.opennebula.io/u/perrfect)\
**Post date:** [October 15, 2021, 9:29am UTC](https://forum.opennebula.io/t/condition-or-for-ldap-in-group/10033/1 "2021-10-15T09:29:51Z")

</div>

Hello.  
I need some help with LDAP, namely with OR condition for group.  
I have two groups on my LDAP-server. First group for opennebula admins, second for opennebula developers:

```auto
oned-admin
oned-dev

```

And i want mapping users from **oned-admin** LDAP-group to _oneadmin_ group in Opennebula and **oned-dev** LDAP-group to _users_ group in Opennebula.

For that i add OR condition for group in a LDAP auth configuration file - ldap\_auth.conf:

> ` :group: '(|(cn=oned-admin,cn=groups,cn=accounts,dc=example,dc=net)(cn=oned-dev,cn=groups,cn=accounts,dc=example,dc=net))'`

But I get an error:

> `User test is not in group (|(cn=oned-admin,cn=groups,cn=accounts,dc=example,dc=net)(cn=oned-dev,cn=groups,cn=accounts,dc=example,dc=net))`

When i do a filter for group without OR condition authentication is success.

> ` :group: 'cn=oned-admin,cn=groups,cn=accounts,dc=example,dc=net'`

Does Opennebula support OR condition in group filter?

---

<div class="post-metadata">

**Author:** ![rdiaz](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.opennebula.io/rdiaz/32/6416_2.png) [@rdiaz](https://forum.opennebula.io/u/rdiaz)\
**Post date:** [October 20, 2021, 6:54pm UTC](https://forum.opennebula.io/t/condition-or-for-ldap-in-group/10033/2 "2021-10-20T18:54:43Z")

</div>

Hi @perrfect,

You can do that by using [Group Mapping](https://docs.opennebula.io/6.0/installation_and_configuration/authentication/ldap.html?highlight=group_dn#group-mapping)

Update both groups with the attribute `GROUP_DN` set to `cn=oned-admin,cn=groups,cn=accounts,dc=example,dc=net` for _oneadmin_ and set to `cn=oned-dev,cn=groups,cn=accounts,dc=example,dc=net` for _users_.

Cheers.

---

<div class="post-metadata">

**Author:** ![perrfect](https://avatars.discourse-cdn.com/v4/letter/p/45deac/32.png) [@perrfect](https://forum.opennebula.io/u/perrfect)\
**Post date:** [October 20, 2021, 7:05pm UTC](https://forum.opennebula.io/t/condition-or-for-ldap-in-group/10033/3 "2021-10-20T19:05:15Z")

</div>

Thank you so much for the reply.

When i will set GROUP\_DN in this case, which  
**:group:** in a config file should i use?

---

<div class="post-metadata">

**Author:** ![TGM](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.opennebula.io/tgm/32/7623_2.png) [@TGM](https://forum.opennebula.io/u/TGM)\
**Post date:** [March 13, 2023, 4:26pm UTC](https://forum.opennebula.io/t/condition-or-for-ldap-in-group/10033/4 "2023-03-13T16:26:00Z")

</div>

@perrfect I’m using a similar config. How did you fixed the problem?

---

<div class="post-metadata">

**Author:** ![perrfect](https://avatars.discourse-cdn.com/v4/letter/p/45deac/32.png) [@perrfect](https://forum.opennebula.io/u/perrfect)\
**Post date:** [March 14, 2023, 8:18am UTC](https://forum.opennebula.io/t/condition-or-for-ldap-in-group/10033/5 "2023-03-14T08:18:13Z")

</div>

Hello.  
It was a long time ago.  
But these configs solved my problem:  
**/etc/one/auth/ldap\_auth.conf**

```auto
server 1:
    :auth_method: :simple
    :host: ldap.example.com
    :port: 636
    :user: 'uid=id,cn=users,cn=accounts,dc=example,dc=com'
    :password: 'some_password_here'
    :encryption: :simple_tls
    :base: 'cn=users,cn=accounts,dc=example,dc=com'
    :group_base: 'cn=groups,cn=accounts,dc=example,dc=com'
    :user_field: 'uid'
    :group_field: 'member'
    :mapping_generate: true
    :mapping_timeout: 300
    :mapping_filename: server1.yaml
    :mapping_key: GROUP_DN
    :mapping_default: false
    :rfc2307bis: false
 
:order:
    - server 1

```

**/var/lib/one/server1.yaml**

* * *

```auto
cn=oned-dev,cn=groups,cn=accounts,dc=example,dc=com: '101'
cn=oned-adm,cn=groups,cn=accounts,dc=example,dc=com: '0'

```