🔗 Ligoj Identity plugin

API plugin used for compatibility check

Ligoj Identity plugin This a very complex plugin managing security constraints depending on the authorization of current user and are massively based on RBAC and delegates. Provides the following features :

• User, group and company management
• Scope of container (group and company) to name macro set of containers
• Delegates to user/group/company of a subset of current user depending on propagation constraints
• Activity export for a group

Dashboard features :

• Amount of users in the linked group

Related plugins:

• plugin-id-sql
• plugin-id-cognito
• plugin-id-ldap
• plugin-id-ldap-embedded

Plugin parameters

Parameter	Scope	Default	Note
service:id:user-display	Global	id	Displayed username mode: id (login), mail (first attached mail, fallback id), mail-short (mail without the domain part), any user attribute name (firstName, lastName, company, ... — also resolved in the customAttributes map, fallback id), or an expression combining ${token} placeholders and literal text, e.g. ${firstName} ${lastName} (each token is one of the previous modes). Whenever the mode or a token cannot be resolved for a user (missing attribute, no mail), the displayed name is this user's visual identifier (service:id:visual-id-name, id by default). The ${...} placeholders are for the UI only: this value is forwarded raw, never resolved by Spring.
service:id:visual-id-name	Global	id	Since Ligoj 5.0 (plugin-id 5.0.2). Attribute displayed as the user's identifier in the UI (table first column, implicit sort): id, firstName, lastName, mail (first one), or customAttributes.<property> (looked up in SimpleUser#customAttributes). The visual-id sort key of UserOrgResource#findAll maps to this attribute; the LDAP repository sorts custom attributes with id fallback. The custom attribute must be named exactly as declared by the identity provider (case-sensitive), otherwise the login is used and a warning is logged.
service:id:visual-id-label	Global	-	Static (non localizable) label displayed for the visual identifier column. When undefined, the UI localizes the visual-id-name value.

The free-text criterion of the user lookups (search[value] of rest/service/id/user, the team leader picker...) matches the login, the first name, the last name, the first mail and every custom attribute value (UserCriteria, shared by the LDAP, SQL and Cognito repositories), so the visual identifier is always searchable. | service:id:uid-pattern | Node, Subscription | .* | Pattern determining the login is valid for an authentication. | | service:id:people-custom-attributes | Node | - | Custom user attribute names, comma or space separated, loaded by the identity tool (LDAP…) and edited in the user dialog. Replaces the tool-level service:id:ldap:people-custom-attributes. | | service:id:read-only-attributes | Node | - | User attributes that cannot be updated after creation, comma or space separated: firstName, lastName, company, department, localId, mail or customAttributes.<name>. The API refuses such an update and the user dialog shows the fields read-only. | | service:id:ou | Node, Subscription | null | Parent OU. | | service:id:group | Node, Subscription | null | Normalized Group name (CN). | | service:id:parent-group | Node, Subscription | null | Normalized parent Group name (CN). |

Node parameters are read once per node and kept in the id-configuration cache; the directory data (users, groups, companies) is kept by the tool plugin (for LDAP, the id-ldap-data cache). After changing the parameters of an identity node (custom attributes, base DN, filters…), invalidate these caches from the cache administration page or with ligoj cache invalidate, or restart the API. Changes of service:id:user-display, service:id:visual-id-name and service:id:visual-id-label apply at the next login.