You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 19 Next »


LDAP integration allows your instance using your LDAP or AD server as the source of the user data. It provides the ability to connect to directory service storing the authentification data, such as usernames, passwords, user home directories used for keeping business and other data, etc. The global objective of the LDAP engine is importing users into the system. And through this, synchronization with various corporate services can be achieved, and one account can be used to authorize in all corporate services, such as email, website, VoIP, and so on.

In this client-server infrastructure scheme, the SimpleOne instance has to be a client connecting to the LDAP server. 

Configuring an LDAP connection


Specifying an LDAP server

To configure an LDAP connection, you need to set up in the system first. For this, please complete the steps below:

  1. Navigate to System LDAP → LDAP Servers.
  2. Click New and fill in the form.
  3. Click Save or Save and Exit to apply changes.

LDAP Server form fields

FieldDescription
NameEnter the server name.
UsernameSpecify the username authenticating the LDAP connection.
PasswordSpecify the server's password.
Root directory

Enter the RDN (relative distinguished name) of the search directory.

Example: dc=simpleone, dc=ru.

ActiveSelect this checkbox to make the server active or inactive.

If the RDN is not specified, then during the authorization process LDAP server will attempt to reach the server root directory; if the user logging on to is not authorized to access this directory, so the authorization process will be interrupted.

Specifying an LDAP URL

Sometimes, customer infrastructure may contain more than one LDAP server, as an example, for fault tolerance. In this case, you may need to specify some particular server used for authorization on the SimpleOne instance.

To perform this, please complete the steps below:

  1. Navigate to System LDAP → LDAP URL.
  2. Click New and fill in the form.
  3. Click Save or Save and Exit to apply changes.

LDAP URL form fields

FieldDescription
URL

Enter the LDAP URL there. Here's an example:

ldaps://192.168.1.12:363

ActiveSelect this checkbox to make the URL active or inactive.
OrderSpecify the order of this URL if there are more than one similar items. In this case, they will be processed in the descending order.
Operational status
  • Error;
  • Disconnected;
  • Connected.
ServerSpecify the appropriate LDAP server (choose it from the previously created).

If you want to establish a secure LDAP connection (LDAP over SSL, LDAPS) via port 636, then you need to provide the SSL-certificate.

For this, please complete the steps below:

  1. Navigate to System LDAP → Certificates;
  2. Click New to create a new record;
  3. Attach your SSL-certificate (.crt or .ca-bundle) file here;
  4. Click Save.

The form will get information from your certificate and place it into relevant fields.

Otherwise, your LDAP connection will proceed insecurely; generally, port 389 (TCP/UDP) is used in this case.

LDAP Definition


After you have configured an LDAP server and an LDAP URL and performed all necessary customer infrastructure preparations, then you are ready to arrange an LDAP Definition. This is a formalized query to the Active Directory server containing the following information:

Importing using LDAP
LDAP Definition form fields
FieldMandatoryDescription
NameYSpecify the LDAP definition name. The name you enter here becomes a target in the Import Sources record.
ActiveNSelect this checkbox to activate the LDAP definition and to allow data import.
Relative Distinguished Name (RDN)NEnter the relative distinguished name (RDN) of the subdirectory to search through.
ServerY

Specify the LDAP server containing users and groups directory and other information related to LDAP.

To configure the server, navigate to System LDAP → LDAP Servers and perform the needed actions.

TableY

Select the target table that will store data from your LDAP server. For users, select the Users (sys_user) table.

The target table specified is used for LDAP auto-provisioning (automatic creation of users in the Users (sys_user) table). This feature can be enabled or disabled by setting the user.ldap_autoprovision property.

FilterN

Enter a filter string to select specific records to import from the OU (organizational unit). 

For example, this filter specifies the excerpt, as shown below:

  • classified as a person
  • have an sn attribute value
  • are not computers
  • are not flagged as inactive
  • and login prerequisites are not equal to 'admin@simpleone.ru'

(&(objectClass=person)(sn=*)(!(objectClass=computer))(!(userAccountControl:1.2.840.113556.1.4.803:=2))(!(userPrincipalName=*.admin@simpleone.ru)))

For more information about LDAP filter syntax, refer to the appropriate RFC.

Query FieldN

Specify the attribute name within the LDAP server for querying the records.

Active Directory mostly uses the sAMAccountName attribute. Other LDAP servers tend to use the cn attribute.

Note that the Query Field is temporarily not working correctly – our team is working on its logic improvement to make it more efficient and secure. We will inform you about changes in the next releases.

Attribute ListN

Use the Attribute List field to specify (include and limit) the attributes the LDAP query returns. This approach is preferable for large LDAP imports in terms of timing.

If the field remains empty, the system loads all the objects with their attributes that your LDAP server is allowed to read.


LDAP System Properties

Some of the LDAP abilities can be configured on the client-side using the System Properties engine. These properties are listed below.

Property nameTypeDefault valueDescription
user.authorization_when_no_ldap_connectionBooleanTrueEnables authorization if there's no LDAP connection. In this case, locally created credentials are used.
user.ldap_authenticationBooleanTrueEnables or disables LDAP authentication.
user.ldap_autoprovisionBooleanTrueEnables the automatic creation of users in the user table in the case of the user is created in LDAP but not created on the instance. 

LDAP Log


In the case of necessity of any troubleshooting with your LDAP integration, you can check the log messages to find the fault causes.

For example, failed authorization attempts, or authorization policy avoidance attempts, all this information will be displayed here.

In fact, all these messages are written to the Logs (sys_log) 

To use LDAP logs, please complete the steps below:

  1. Navigate to System LDAP → LDAP log.
  2. Find the records you are interested in using the Condition Builder, and other filtering tools, such as List layout#ShowMatching or List layout#FilterOut functionality.

LDAP Log form fields

FieldDescription
SourceDisplays the source from where this log record comes from (LDAP Authorization or LDAP Autoprovision, as an example).
Level

This field specifies the error level. Available options:

  • Info;
  • Error;
  • Warning;
  • Debug.
MessageThe log record message text.

  • No labels