| Panel | ||||
|---|---|---|---|---|
|
...
You can set up Universal Controller to use LDAP authentication for:
| Anchor | ||||
|---|---|---|---|---|
|
To use LDAP authentication for Universal Controller user credentials:
UNIX | If you want the credentials for Universal Agent to go through LDAP authentication, the UNIX machine on which the Agents reside require PAM. The Agents must be configured to use PAM, and PAM must be configured to use LDAP. |
|---|---|
Windows | While no set-up steps are required to specifically enable Domain/Active Directory credential authentication, the target system does need to belong to a Domain or Active Directory Forest. When you specify credentials for a task, use DOMAIN\user as the user name. |
| Anchor | ||||
|---|---|---|---|---|
|
Step 1 | From the Administration navigation pane, select Configuration > LDAP Settings. The LDAP Settings page displays. |
|---|---|
Step 2 | Enter / select your LDAP Settings, using the field descriptions below as a guide.
|
Step 3 | Click the |
For information on how to access additional details - such as Metadata and complete database Details - for LDAP Settings (or any type of record), see Records.
| Note | ||
|---|---|---|
| ||
In order to log in to the Controller using LDAP, you must set the LDAP Synchronization Enabled Universal Controller System property (Administration > Configuration > Properties in the Controller user interface) to true. |
...
Field Name | Description | ||||||
|---|---|---|---|---|---|---|---|
Connection | This section contains information on the LDAP connection. | ||||||
URL | URL of the LDAP connection. For example:
To use SSL/TLS encryption (
| ||||||
| Distinguished Name (DN) or User ID used for initial access to the LDAP server. | ||||||
Bind Password | Password associated with the Bind ND or User. | ||||||
Use for Authentication | If enabled, indicates that LDAP will be used for password authentication. | ||||||
Allow Local Login | If the LDAP Synchronization Enabled Universal Controller system property is false, or if it is true but the Use for Authentication 206427338 field is not enabled, an administrator must explicitly specify Allow Local Login to allow local account login for users that were provisioned through LDAP synchronization. | ||||||
Search | This section contains search information. | ||||||
| Starting point for searching the directory. For example: | ||||||
User Id Attribute | LDAP attribute for the specified User ID.
| ||||||
User Filter | Search filter for users. | ||||||
User Target OU List | Single- or multi-level target OU's (Organizational Units) within the Base DN 206427338 directory to filter for user records. | ||||||
Group Filter | Search filter for groups. | ||||||
Group Target OU List | Single- or multi-level target OU's within the Base DN 206427338 directory to filter for group records. | ||||||
Advanced | This section contains advanced information. | ||||||
Connection Timeout (Seconds) | Timeout for connecting to the LDAP server. | ||||||
Read Timeout (Seconds) | Timeout for reading from the LDAP server. | ||||||
User Membership Attribute | LDAP attribute for the groups in which a user is a member. If you do not specify a User Membership Attribute, the LDAP server uses memberOf (see the | ||||||
Group Member Attribute | LDAP attribute for the members of a group. If you do not specify a Group Member Attribute, the LDAP server uses member (see the | ||||||
Login Method | Login method(s) that an LDAP-provisioned user can authenticate with by default. The default is applied only at user creation time. You can use the Ctrl key to select both multiple methods. Only one of Standard or Standard / Authenticator App (TOTP) can be selected, not both.
| ||||||
Buttons | This section identifies the buttons displayed above and below the LDAP Settings that let you perform various actions. | ||||||
Update |
| ||||||
| After saving the LDAP Settings to the database, click Test Connection to run a connection test. | ||||||
Refresh | Refreshes any dynamic data displayed in the LDAP Settings. | ||||||
Tabs | This section identifies the tabs across the top of the LDAP Settings page that provide access to additional information about the LDAP Settings. | ||||||
Mappings | List of User and Group columns mapped to LDAP attributes that enables you to customize how the User/Group records get populated from LDAP. |
...
You specify the User and Group Target OUs relative from the Base DN 206427338. In this case, the Base DN would be OU=Corporate,DC=stonebranch,DC=com.
For the User Target OU List 206427338 LDAP Settings field, you would have the following entries:
OU=NorthAmerica,OU=CorporateUsers |
OU=Students |
For the Group Target OU List 206427338 LDAP Settings field, you would have the following entries:
...
For each User and Group record in the Controller that represents a synchronized LDAP User or Group, the Source column on the Users list or Groups List, respectively, contains the Distinguished Name of that User or Group in LDAP. (For Users and Groups created locally in the Controller, the Source column is blank.)
...
| Note | ||
|---|---|---|
| ||
By default, the Source column is not shown on either lists. For instructions on how to add the Source column, see Selecting Columns / Column Locations for a List. |
| Anchor | ||||
|---|---|---|---|---|
|
...
Additionally, the Controller provides two Server Operations that let you force an LDAP refresh:
...
Once LDAP configuration has been completed, you can utilize the LDAP Refresh server operation to verify your configuration.
...
1 | Do not explicitly specify a value for the Group search filter. |
|---|---|
2 | Do not specify any target Group OUs (organizational units). |
3 | Ensure that the Universal Controller Start-up Properties file ( |
...
It requires setting up a truststore (keystore) and setting the following properties in the Universal Controller Start-up Properties (uc.properties) file:
...
When these configurations have been made, use ldaps:// for the URL prefix in the LDAP Settings Field Descriptions 206427338.