Configuring LDAP authentication
To enable authentication of users by an external LDAP server , you first have to configure how to access that server.
The settings for this configuration can be found in the file config/environment_settings.xml within the group "ldap"
Configuration of the authentication mode
The first thing one has to define is the ldap mode that is used for authentication. This configuration is given by the ldap.mode attributed. If this attribute is set to DEFAULT, the authentication type is derived from the given parameter settings. The following modes are supported:
| Type | Description |
|---|---|
| Bind | This ldap strategy tries to connect directly to the ldap-directory with the credentials provided by the log in. This is typically used with Microsoft ActiveDirectory because there is not visible password attribute. Please specify the following attributes if you want to use this ldap mode. ldap.RequestPattern |
| LoadCompare | Load a user by a list of user dn's and compare it against the password attributes found in the ldap directory. Please specify the following attributes if you want to use this ldap mode. ldap.RequestedAttribute, ldap.RequestPattern When an authentication is required to execute the user search, please specify the account by setting ldap.UserDn, ldap.UserPassword |
| QueryBind | This strategy uses a search query to find user objects in the ldap directory. If a user is found, the user in combination with the provided password is authenticated directly against the ldap directory. Please specify the following attributes if you want to use this ldap mode. ldap.BaseDn, ldap.SearchFilter, ldap.SearchSubtree When an authentication is required to execute the user search, please specify the account by setting ldap.UserDn, ldap.UserPassword |
| QueryCompare | This strategy uses a search query to find a user object. If a user object is found, the password is compared against the password attribute found in the ldap directory. Please specify the following attributes if you want to use this ldap mode. ldap.BaseDn, ldap.SearchFilter, ldap.SearchSubtree, ldap.RequestedAttribute When an authentication is required to execute the user search, please specify the account by setting ldap.UserDn, ldap.UserPassword |
The ldap attributes have the following meaning
| Attribute | Description |
|---|---|
| ldap.BaseDn | The path to a context where the user is to be searched. Not required if RequestPattern is set. Example: ou=Users,dc=soffxt,c=at |
| ldap.RequestPattern | A pattern describing the DN to the user we want to request. Within this pattern {0} is replaced by the user name. Example: (cn={0},ou=Users,dc=soffxt,c=at) |
| ldap.RequestedAttribute | The name of the attribute we request; typically Example: userPassword |
| ldap.SearchFilter | The filter to execute in the context given by BaseDn. Within this pattern {0} is replaced by the user name. Example: (uid={0}) |
| ldap.SearchSubtree | If true, then all subtrees under the BaseDn are searched using the SearchFilter. Not required if RequestPattern is set. |
| ldap.StartTLS | Enable StartTLS to establish a secure connection (recommended) |
| ldap.URL | The URL to the LDAP server. Use ldaps:// as protocol to secure your connection using TLS (excludes using StartTLS). |
| ldap.UserDn | The distinguished name of the user with which Solution Hub authenticates itself on the LDAP server Example: cn=admin,dc=soffxt,c=at |
| ldap.UserPassword | The password which is used when Solution Hub authenticates itself on the LDAP server |
| ldap.anonymous.group | Defines the ldap attribute or query, depending on the ldap.anonymous.group.mode setting. |
| ldap.anonymous.group.BaseDn | The path to a context where the groups is to be searched. If blank, the ldap.BaseDn setting is used. |
| ldap.anonymous.group.mode | Defines the mode of parameter ldap.anonymous.group. - ATTRIBUTE: the parameter defined as an attribute name. The group membership is obtained by retrieving the value of the attribute over the user context. - QUERY: the parameter defined as an query. The group membership is obtained by executing a query against the LDAP server. |
| ldap.anonymous.mapping | Defines the mapping overwritten mode. - OVERWRITE: the roles and the scenarios assignments of the user will be overwritten automatically with the settings derived from the LDAP configuration. - ROLES_ONLY: only the roles assignments of the user will be overwritten. - SCENARIOS_ONLY: only the scenarios assignments of the user will be overwritten. - PRESERVE: the LDAP settings are only applied during the first login of the user. - Otherwise, the local solution hub assignments are preserved. |
| ldap.anonymous.mode | If set to true, any user that is positive authenticated against LDAP can work with solution hub (Note: In this case an Solution Hub user that is defined by parameter ldap.defaultUser must exist. The rights of this user are taken for the anonymous log in). If set to false, an solution hub account must exist for the LDAP user. |
| ldap.mode | If true, then all subtrees under the BaseDn are searched using the SearchFilter. Not required if RequestPattern is set. |
| ldap.anonymous.mapping | If this parameter is set to OVERWRITE, the roles and the scenarios assignments of the user will be overwritten automatically with the settings derived from the LDAP configuration. If ROLES_ONLY is set, only the roles assignments of the user will be overwritten. If SCENARIOS_ONLY is set, only the scenarios assignments of the user will be overwritten. If PRESERVE is set, the LDAP settings are only applied during the first log in of the user. Otherwise, the local Solution Hub assignments are preserved. |
| ldap.anonymous.group.mode | Defines the mode of parameter ldap.anonymous.group: ATTRIBUTE: the parameter defined as an attribute name. The group membership is obtained by retrieving the value of the attribute over the user context. QUERY: the parameter defined as an query. The group membership is obtained by executing a query against the LDAP server. |
| ldap.anonymous.group | Defines the ldap attribute or query, depending on the ldap.anonymous.group.mode setting. Example for ATTRIBUTE mode: memberOf Example for QUERY mode: (&(member=$(dn))(objectClass=Group)) |
| ldap.anonymous.group.BaseDn | The path to a context where the groups is to be searched, to be used for QUERY mode. If blank, the ldap.BaseDn setting is used. |
Using an encrypted connection
To encrypt the communication with the LDAP server on a transport layer you have two choices: TLS and STARTTLS.
When using TLS, Solution Hub directly connects to the LDAPS port (normally 636) of the server.
When using STARTTLS, the connection starts unencrypted on the LDAP port (normally 389) and upgrades the connection by negotiating encryption details with the server.
Enable TLS
To enable TLS use ldaps:// as prefix of the ldap.URL parameter. Make sure to change the port, if needed.
Enable STARTTLS
To enable STARTTLS you must leave the ldap.URL parameter unchanged but enable ldap.StartTLS (this is the default).