LDAP Integration

The Lightweight Directory Access Protocol (LDAP) is an open, vendor-neutral, industry-standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network.

LDAP integration allows connecting your instance to LDAP or AD server and using it as a source of the user data. It provides the ability to connect to directory service storing the authentication data, such as usernames, passwords, user home directories used for keeping business and other data, etc. The global objective of the LDAP engine is importing users into the system. And through this, synchronization with various corporate services can be achieved, and one account can be used to authorize in all corporate services, such as email, website, VoIP, and so on.

The RDN (relative distinguished name) is the attribute defining the search directory like this: dc=instance,dc=com

In this client-server infrastructure scheme, the SimpleOne instance has to be a client connecting to the LDAP server.

The system synchronizes with the LDAP server in two ways:

• via the Schedule Jobs (automatic) – scheduled script defining periods of synchronization (for example, every 3 hours). See the Scheduled Script article to learn more.
• via the Autoprovision (triggered by logging in) – when user logs in, the system updates the requested data. Configure this way of synchronization via the user.ldap_autoprovision property.

Establishing LDAP connection

To establish the connection between your SimpleOne instance and the LDAP server, complete the following steps:

1. Specify the LDAP server.
2. Define the LDAP URL.
   • (Optional) Add a certificate to create a secure LDAP connection.
3. Set up the LDAP Definition.
4. Check settings.
5. (Optional) Data import.

Additional tools for setting up LDAP connection:

• LDAP log
• LDAP system properties

Specifying an LDAP server 

To configure an LDAP connection, complete the steps below:

1. Navigate to System LDAP → LDAP Servers.
2. Click New and fill in the fields.
3. Click Save to apply changes.
4. Copy the current record ID.

Defining an LDAP URL

Sometimes, customer infrastructure may contain more than one LDAP server, for example, as a standby (reserve) server. In this case, you may need to specify some particular server used for authorization by arranging the URL order. If you have more than one server, create a separate LDAP URL for each of them.

To create a URL, complete the steps below:

1. Navigate to System LDAP → LDAP URL.
2. Click New and fill in the fields.
3. Click Save or Save and Exit to apply changes.

Adding a certificate

If you want to establish a secure LDAP connection (LDAP over SSL, LDAPS) via port 636, you need to provide the SSL certificate.

For this, please complete the steps below:

1. Navigate to System LDAP → Certificates.
2. Click New to create a new record.
3. Attach your SSL-certificate (.crt or .ca-bundle) file here.
4. Click Save or Save and Exit to apply changes.

The form will get information from your certificate and place it into relevant fields. Otherwise, your LDAP connection will proceed insecurely; generally, port 389 (TCP/UDP) is used in this case.

LDAP Definition 

After configuring an LDAP server and an LDAP URL and performing all necessary customer infrastructure preparations, you are ready to set up an LDAP definition.

To configure the LDAP definition, perform the following steps:

1. Navigate to System LDAP → LDAP Definition.
2. Click New and fill in the fields.
3. Click Save or Save and Exit to apply changes.

You can check the LDAP structure by clicking the Browse LDAP on the corresponding LDAP Server record.

Checking settings 

Make sure that the connection is set up by performing the following steps:

1. Navigate to System LDAP → LDAP Servers.
2. Open the record you need.
3. Click Test connection. The system will check the first URL connection defined by the order. If the connection is fine, you will see the Successfully connected message.
4. Click Test all connections. The system will check all defined connections. If the connections are fine, you will see the All connections are checked message.

If an error is thrown, check LDAP Log records.

LDAP Import

Import all necessary data from your LDAP server to the instance. 

To complete the data import using LDAP, you will need to set up the following system elements:

• LDAP Definition – specifies filters for retrieving data from a defined LDAP table.
• Import Source – loads row data for further processing and transformation.

The scheme below illustrates the process of data import from an LDAP server.

See the Importing using LDAP article to learn more.

LDAP Log 

In case the system threw an error, you can check the log messages to find the cause. In the LDAP Log, you can find records of failed authorization attempts or authorization policy avoidance attempts. In fact, all these messages are written into the Logs (sys_log) table.

To see the LDAP logs, navigate to System LDAP → LDAP log.

LDAP System Properties

Some of the LDAP abilities can be configured on the client-side using the System Properties engine. These properties are listed below.

.