LDAP Authentication(3.1)

User authentication is by default performed in . As an alternative, you can connect to an external LDAP directory for delegated authentication. This facilitates automation of administrative tasks such as creation of users and assigning access groups.

If the external authentication server returns an error or cannot be accessed, will perform the authentication internally as a fallback method.

The Authentication Methods drop-down list is only available if LDAP Authentication is installed.

Note!

Configuration performed from the Users Tab has no impact on external authentication servers.

LDAP Authentication Preparations

This section does not apply if authentication is to be performed by .

NOTE: For Active directory specific settings check Active Directory Important Information

Directory Structure

The LDAP directory that is used for authentication must conform to the following requirements:

The cn attribute of group entries must match an access group defined in .

Note!

performs case sensitive comparisons of the cn attributes and access groups.
For each user in a group entry, the memberUid attribute must be set.
All group entries must belong to the object class posixGroup.
All user entries must belong to the objectclass posixAccount.
The username must be unique. It cannot duplicate a username that already exists in .

Note!

If a user requires administration rights, they must be added to the Administrator access group, which is a default access group in , and you must create a group named Administrator in the LDAP directory.

Secure Access

The following steps are required before configuration of authentication with LDAPS or LDAP over TLS:

Obtain the server certificate for the authentication server from your LDAP administrator.
Start a command shell and copy the server certificate to the platform host.
Change directory to $JAVA_HOME/lib/security on the platform host.
Install the server certificate using the Java keytool command:
```
keytool -import -file <certificate> -keystore cacerts 
```

Active Directory Important Information

Directory Structure

The LDAP directory that is used for authentication must conform to the following requirements:

All user entries must belong to the objectclass user .
User's groups have to be provided via memberOf attribute.
User's login has to be provided via samaccountname attribute.
The username must be unique. It cannot duplicate a username that already exists in .

Note!

If a user requires administration rights, they must be added to the Administrator access group, which is a default access group in, and you must create a group named Administrator in the LDAP directory.

LDAP Configuration

Access Controller - Advanced tab with LDAP Authentication

Setting	Description
Authentication Methods	The Authentication Methods setting is only available if LDAP Authentication is installed. Select the authentication method to be used. The following settings are available: Default LDAP The default setting is authentication performed by . The selected authentication method becomes effective when the configuration is saved. Note! Authentication for the user mzadmin is always performed by regardless of the selected authentication method.
URL	Enter the URL for the external authentication server. The default ports, 389 for LDAP and 686 for LDAPS, are used unless other ports are specified in the URL. When using LDAP, you may connect via LDAPS by entering `ldaps://` in the URL. Example of LDAP URL ldap://ldap.example.com:389 Example of LDAPS URL ldaps://ldap.example.com:636
Test Connection	Click this button to test the connection to the authentication server. LDAP attributes and other settings than the URL are not used when testing the connection.
User Base DN	Enter the LDAP attributes for user lookups in the external authentication server. The substring %s in this value will be replaced with the username entered at login to produce an identifier that is passed to the LDAP server. Example of User Base DN uid=%s,ou=users,dc=digitalroute,dc=com
Group Base DN	Enter the LDAP attributes for group lookups in the external authentication server. Example of Group Base DN ou=groups,dc=digitalroute,dc=com The name of the groups must be identical to the names configured in Access Groups.
TLS	Select this check box to enable Transport Layer Security. Note! The following must be considered when using TLS: LDAPS and TLS is not a valid combination. The URL must contain a fully qualified DNS name or the authentication will fail. The default LDAP port, 389, should be used.
AD Naming	Select this check box if you want to use Active directory specific naming.
Enable	Select this check box if you want to enable group search bind credentials. You must also populate the Bind DN and Password fields. If you want to run an anonymous lookup, leave this check box empty.
Bind DN	If you want to use a specific Bind DN to search for the group, enter the Bind DN.
Password	If you want to use a specific Bind DN to search for the group, enter the password for the Bind DN.