LDAP Authentication
Defines handling for authenticating Orchestra Runtime users using LDAP.
There are several methods for authenticating against LDAP servers.
LDAP Authentication Parameters
| Parameter | Description |
|---|---|
| ldap.BaseDn | Path to the context where the user is searched. Not required if RequestPattern is set. |
| ldap.RequestPattern | Pattern describing the DN of the user. {0} is replaced by the username defined in the Orchestra Runtime User/Password authentication. |
| ldap.RequestedAttribute | Name of the attribute to be requested, typically userPassword. If missing along with UserDn, Orchestra attempts to log in directly with the requested user and password. |
| ldap.SearchFilter | Filter executed in the context specified by BaseDn. {0} is replaced by the username. Not required if RequestPattern is set. |
| ldap.SearchSubtree | If true, all subtrees under BaseDn are searched using the SearchFilter. Not required if RequestPattern is set. |
| ldap.StartTLS | Enables (true) or disables (false) STARTTLS. If enabled, Orchestra starts with an insecure connection and upgrades to TLS. Requires ldap:// (not ldaps://) and usually port 389. |
| ldap.URL | URL to access the LDAP server. Use ldap:// for plain connections, ldaps:// for TLS encrypted. TLS is incompatible with StartTLS. |
| ldap.UserDn | Distinguished name of the user with which Orchestra authenticates itself on the LDAP server. |
| ldap.UserPassword | Password used by Orchestra to authenticate itself on the LDAP server. |
| ldap.anonymous.group | Defines the LDAP attribute or query, depending on ldap.anonymous.group.mode. |
| ldap.anonymous.group.mode | Defines how ldap.anonymous.group is interpreted:ATTRIBUTE – Uses the value of the attribute in the user context. QUERY – Executes a query against the LDAP server to obtain group membership. |
| ldap.anonymous.mapping | Determines how roles and scenarios from LDAP override local Orchestra settings: OVERWRITE – Overwrites both roles and scenarios. ROLES_ONLY – Overwrites only roles. SCENARIOS_ONLY – Overwrites only scenarios. PRESERVE – LDAP applies only on first login; afterward, local assignments remain. |
| ldap.anonymous.mode | If true, any LDAP-authenticated user can work with Orchestra. Requires an Orchestra user defined by ldap.defaultUser, whose rights are used. If false, an Orchestra account must exist for the LDAP user. |
| ldap.mode | Defines the authentication strategy. If set to DEFAULT, mode is determined automatically from parameters; otherwise, explicitly defines the LDAP authentication strategy. |