{"action":"created","issue":{"url":"https://api.github.com/repos/cloudfoundry/cf-release/issues/764","labels_url":"https://api.github.com/repos/cloudfoundry/cf-release/issues/764/labels{/name}","comments_url":"https://api.github.com/repos/cloudfoundry/cf-release/issues/764/comments","events_url":"https://api.github.com/repos/cloudfoundry/cf-release/issues/764/events","html_url":"https://github.com/cloudfoundry/cf-release/issues/764","id":100317031,"number":764,"title":"group mapping issue of UAA ldap integration","user":{"login":"liuxiaoxi2237","id":13224933,"avatar_url":"https://avatars.githubusercontent.com/u/13224933?v=3","gravatar_id":"","url":"https://api.github.com/users/liuxiaoxi2237","html_url":"https://github.com/liuxiaoxi2237","followers_url":"https://api.github.com/users/liuxiaoxi2237/followers","following_url":"https://api.github.com/users/liuxiaoxi2237/following{/other_user}","gists_url":"https://api.github.com/users/liuxiaoxi2237/gists{/gist_id}","starred_url":"https://api.github.com/users/liuxiaoxi2237/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liuxiaoxi2237/subscriptions","organizations_url":"https://api.github.com/users/liuxiaoxi2237/orgs","repos_url":"https://api.github.com/users/liuxiaoxi2237/repos","events_url":"https://api.github.com/users/liuxiaoxi2237/events{/privacy}","received_events_url":"https://api.github.com/users/liuxiaoxi2237/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-08-11T13:57:17Z","updated_at":"2015-08-11T14:44:03Z","closed_at":null,"body":"Hi expert,\r\nldap integration  config in cf-deployment.yml as below\r\n---------------------\r\nMy issue:\r\nI can login in with a ldap user successfully. but when run \"cf create-user abc 123\" or \"cf orgs\", get error:  Server error, status code: 403, error code: access_denied, message: Invalid token does not contain resource id (scim)\r\nseems  group mapping not work.\r\n-----------------------\r\n\r\n      ldap:\r\n          enabled: true\r\n          profile_type: search-and-bind\r\n          url: ldap://x.x.x.x:389/\r\n          mailAttributeName: mail\r\n          userDN: 'cn=xx,cn=xx,dc=xx,dc=xx'\r\n          userPassword: 'xx'\r\n          searchFilter: 'cn={0}'\r\n          searchBase: 'cn=users,dc=xx,dc=xx'\r\n          groups:\r\n            profile_type: groups-map-to-scopes\r\n            autoAdd: true\r\n            searchBase: 'cn=xxx,dc=xx,dc=xx'\r\n            groupRoleAttribute: 'spring.security.ldap.dn'\r\n            groupSearchFilter: 'member={0}'\r\n            searchSubtree: true\r\n            maxSearchDepth: 10\r\n    scim:\r\n          external_groups:\r\n          - scim.write|cn=cfadmin,cn=users,dc=xx,dc=xx\r\n          - scim.read|cn=cfadmin,cn=users,dc=xx,dc=xx\r\n          - cloud_controller.admin|cn=cfadmin,cn=users,dc=xx,dc=xx\r\n          - openid|cn=cfadmin,cn=users,dc=xx,dc=xx\r\n          - doppler.firehose|cn=cfadmin,cn=users,dc=xx,dc=xx\r\n          - clients.admin|cn=cfadmin,cn=users,dc=xx,dc=xx\r\n          - uaa.admin|cn=cfadmin,cn=users,dc=xx,dc=xx\r\n          - zones.write|cn=cfadmin,cn=users,dc=xx,dc=xx\r\n          - password.write|cn=cfadmin,cn=users,dc=xx,dc=xx\r\n\r\n\r\nAny suggestions,\r\nthanks,\r\nDavid\r\n"},"comment":{"url":"https://api.github.com/repos/cloudfoundry/cf-release/issues/comments/129912582","html_url":"https://github.com/cloudfoundry/cf-release/issues/764#issuecomment-129912582","issue_url":"https://api.github.com/repos/cloudfoundry/cf-release/issues/764","id":129912582,"user":{"login":"youngm","id":438661,"avatar_url":"https://avatars.githubusercontent.com/u/438661?v=3","gravatar_id":"","url":"https://api.github.com/users/youngm","html_url":"https://github.com/youngm","followers_url":"https://api.github.com/users/youngm/followers","following_url":"https://api.github.com/users/youngm/following{/other_user}","gists_url":"https://api.github.com/users/youngm/gists{/gist_id}","starred_url":"https://api.github.com/users/youngm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/youngm/subscriptions","organizations_url":"https://api.github.com/users/youngm/orgs","repos_url":"https://api.github.com/users/youngm/repos","events_url":"https://api.github.com/users/youngm/events{/privacy}","received_events_url":"https://api.github.com/users/youngm/received_events","type":"User","site_admin":false},"created_at":"2015-08-11T14:44:03Z","updated_at":"2015-08-11T14:44:03Z","body":"One other thought.  I've noticed recently that it appears `external_groups:` config doesn't appear to work.  I haven't had time to get to the root of the problem.\r\n\r\nI've had to add my groups via `uaac`.  What does the output of `uaac group mappings` look like?"}}