LDAP Authentication

Owned by Kevin Wu
Last updated: Jul 10, 2024
4 min read

User authentication is by default performed in MediationZone. As an alternative, you can connect to an external LDAP directory for delegated authentication. This facilitates automation of administrative tasks such as creation of users and assigning access groups.

When you create a new user in the Access Controller Users tab, the system will verify against the LDAP Server to make sure that the new user name does not already exist in the LDAP Server.  If the LDAP Server is down, you will not be able to create or edit any LDAP users in Users tab.

Users that are already included in the Access Controller's Users Tab can still login to the system even when the LDAP Server is down.

Note!

User created using the Users Tab in Access Controller will not be impacted nor will they have an impact on external authentication servers. 

 

Note!

LDAP users will not appear in Access Controller Users Tab.

LDAP Authentication Preparations

Directory Structure

The LDAP directory that is used for authentication must conform to the following requirements:

  1. The cn attribute of group entries must match an access group defined in the system.



  2.  For each user in a group entry, the memberUid attribute must be set.

  3.  All group entries must belong to the object class posixGroup.

  4.  All user entries must belong to the objectclass posixAccount. 

  5. The username must be unique. It cannot duplicate a username that already exists in the system.

Note!

If users require administration rights, they must be added to the Administrator access group, which is a default access group. You must create a group named Administrator in the LDAP directory.

Secure Access 

The following steps are required before configuration of authentication with LDAPS or LDAP over TLS:

  1.  Obtain the server certificate for the authentication server from your LDAP administrator.
     

  2.  Start a command shell and copy the server certificate to the platform host.
     

  3.  Change directory to $JAVA_HOME/lib/security on the platform host.
     

  4.  Install the server certificate using the Java keytool command:

    keytool -import -file <certificate> -keystore cacerts

Active Directory Important Information

Directory Structure

The LDAP directory that is used for authentication must conform to the following requirements:

  1. All user entries must belong to the objectclass user .

  2. User's groups have to be provided via memberOf attribute.

  3. User's login has to be provided via samaccountname attribute.

  4. The username must be unique. It cannot duplicate a username that already exists in the system.

LDAP Configuration

Select LDAP in Authentication Method dropdown list in the Access Controller Advanced tab.

Access Controller - Advanced tab with LDAP Authentication example

 

Setting

Description

Setting

Description

Authentication Method

Select the authentication method to be used. The following settings are available:

  • Default

  • LDAP

The default setting is authentication performed by MediationZone.

The selected authentication method becomes effective when the configuration is saved.



URL

Enter the URL for the external authentication server. The default ports, 389 for LDAP and 686 for LDAPS, are used unless other ports are specified in the URL.

 

 

Test Connection

Click this button to test the connection to the authentication server. LDAP attributes and other settings than the URL are not used when testing the connection.

User Base DN

Enter the LDAP attributes for user lookups in the external authentication server. The substring %s in this value will be replaced with the username entered at login to produce an identifier that is passed to the LDAP server.

 

Group Base DN

Enter the LDAP attributes for group lookups in the external authentication server.

 

 

Use TLS

Select this check box to enable Transport Layer Security.

 

Use Active Directory  Naming

Select this check box if you want to use Active directory specific naming.

Enable Group Search Bind Credentials

Select this check box if you want to enable group search. You must also populate the Bind DN and Password fields. If you want to run an anonymous lookup, leave this check box empty.

Bind DN

If you want to use a specific Bind DN to search for the group, enter the Bind DN.

Password

If you want to use a specific Bind DN to search for the group, enter the password to connect LDAP Server.