Integration with a huge LDAP directory

[16年前 に Bala R によって更新されました。]

I'm evaluating Liferay Portal to use it in our department with huge number of users and groups. First I want to appreciate Liferay community for their great work. Liferay Portal 'looks' very simple, dynamic and easy to use for both administrators and end users. Its biggest plus is the number of useful Portlets, especially the Collaboration Portlets, that comes out of the box.

We currently use an LDAP based Identity Management System that maintains department's users and groups. We roughly have around 4 million user accounts and around 150,000 user groups and still growing.

From the documentation I could figure out Liferay's current LDAP integration is to import users, user groups and their membership from LDAP into its Portal database and to keep it in sycn with the LDAP regularly. Obviously this solution won't work with LDAP that holds huge number of users and groups and in which users and groups are constantly added and re-grouped.

Is it possible to make Liferay use users and groups in LDAP without copying them into its database? JBoss Portal provides LDAP Identity Modules to accomplish this. Does Liferay provide anything similar? If it doesn't have what is its recommended approach? Is it possible to add such capability into it?

Thanks in advance.

[15年前 に Ron Bense によって更新されました。]

Yes, you can pretty much edit any piece of the codebase. LDAP integration isn't too bad, but you'll have to look at Liferay 5.0 to see if the users can remain outside of Liferay's DB. the 4.x requires importation of all users. Groups are optional, liferay has its own concept of groups.

[14年前 に Sanjay Kannan によって更新されました。]

Does anybody have an answer to this. We were able to integrate with Microsoft AD but liferay pulls all the user/user groups to its DB. Can this be avoided.

[13年前 に Archi Madhu によって更新されました。]

Hi there,

Check for PortalLDAPUtil.java and AuthPipeline.java....
I would suggest dig into this two file ..and you should be able to get your answer.

HTH!
Archi

[13年前 に James McGovern によって更新されました。]

To answer your question requires asking several additional questions:

1. Are you looking for Liferay to support static LDAP groups where the admin specifies one and only one group and it is their job to nest them as appropriate?

2. Do you expect Liferay to provide some sort of admin UI to administer LDAP groups?

3. Do you want 100% of your groups to be in LDAP or do you want to specify that some are in LDAP and some are in the product?

4. Would you consider an approach that uses Oracle Virtual Directory as an intermediate layer?