Restrict User Access to SSPR via Group Membership

In your Configuration Editor, go to LDAP > LDAP Directories > {select your profile, often "default"}. From here you need to look for "Username Search Filter."

Above is the default parameter that is set in SSPR at installation. You'll want to replace it with the following, depending on eDirectory or Active Directory:

(&(objectClass=person)(cn=%USERNAME%)(groupMembership={full group context here}))

Example - (&(objectClass=person)(cn=%USERNAME%)(groupMembership=cn=ssprAccess,ou=groups,o=data))

(&(objectClass=person)(sAMAccountName=%USERNAME%)(memberOf={full group context here}))

Example - (&(objectClass=person)(sAMAccountName=%USERNAME%)(memberOf=CN=ssprADAccess,CN=Users,DC=chansen7,DC=lab,DC=novell,DC=com))

In each case, it is looking for the username that is entered at login, and then verifying that it's a part of the group specified in the filter.

Please note - If you have changed the LDAP Naming Attribute under the LDAP Profile settings to be anything other than cn for eDirectory, or sAMAccountName for Active Directory, then you need to change them in the above example filters respectively.

If, for example, I logged in with a username of cn=test,ou=sa,o=data, and then entered in a password, it will ignore the above settings because they are specific to contextless login, and still proceed to log the user in.