LDAP mapping - how to find which groups led to this user?

[ehudb]

We have configured LDAP mapping groups rules.
We have some users found in "Users" page, that we cannot determine how to received these roles.

Is there any way in the logs or other tools where we can find out which mapping rules added this user to these roles?
It could be more than just one mapping rule.

I tried to raise DEBUG level in "ScopedLDAPConnection" and "AuthenticationManagerLDAP", but we get separate events for users and events for groups, no events are correlating them both.

[kunalmao]

Do a ldap search with
ldapsearch -x -H
you can get complete syntax online, just substitute the user name and it will give you details about which all AD group the user is part of then you can check

Please let me know if it helps

[ehudb]

Hi
I can easily find all groups that the user is member of in LDAP.
But lets say he has hundreds of them, and multiple groups can participate in the mapping process,
How can I tell which of them used in the mapping process?

[kunalmao]

It should be in _audit logs i guess.