...

• A service defines the target UDMG Server and the supported authentication mechanism or provider.
• A provider define defines the type and the actual configuration for the related identity provider, for example the address of the LDAP server and the needed entity mapping.

...

By default, the local authentication is always enabled for all services.

SSO

...

Local Authentication

Local authentication is the standard authentication with usernames and passwords that are stored in the UDMG Server database. It is available for UDMG Admin UI, the REST API interface and the UDMG Client command line tool.

Single Sign-On Settings

Before you begin

In order to provide an integration via a an SSO Provider you will need to map a user with the email under the Admin UI.

Image Removed

LDAP

LDAP Service, it is required that the UDMG users have an email value.

This is the identifier that is shared between UDMG and the Identity Provider

Image Added

Configuration

Please refer to the pages:

• SSO with Google, OpenID, and OAuth2 Identity Providers
• SSO SAML Settings

LDAP Settings

UDMG Admin UI login page with the LDAP provider.

Image Added

Example of a service section in UDMG Authentication Proxy for LDAP authentication

[service.ldap]
protocol = "http"
policy = "failover"

[service.ldap.credential]
username = "ldap_sync"
password = "ldap_password"

[[service.local.ldap.targets]]
hostname = "localhost"
port = 18080

[service.ldap.auth.ldap]
file = "udmg-ldap-config.json"

...

The details of the LDAP server are defined in the JSON file. 

User Provisioning

In case of successful authentication on the LDAP, the UDMG user is created with default Read permission in the internal UDMG database if it does not exist. Otherwise the user credentials are updated in the database to allow for authentication on the REST and CLI interfaces.

Default permissions after the user provisioning:

Image Added

The LDAP replication requires a user with permission for creating and updating users. For example to create the 'ldap_sync' user with the command line interface:

[service.local.auth.ldap]
file = "udmg-client user add -u ldap_sync -p ldap_password -r 'U=rw'

Anonymous Binding

Example of provider configuration file udmg-ldap-config.json

...

 for anonymous binding on the LDAP server.

{
  "host": "localhostldap:1389",
  "insecureNoSSL": true,
  "usernamePrompt": "Email Address",
  "userSearch": {
    "baseDN": "dc=stonebranch,dc=com",
    "filter": "(objectClass=*)",
    "username": "cn",
    "idAttr": "uidNumber",
    "emailAttr": "uidNumber",
    "nameAttr": "cn"
  },
  "groupSearch": {
    "baseDN": "ou=readers,dc=stonebranch,dc=com",
    "filter": "(objectClass=groupOfNames)",
    "userMatchers": [
      {
        "userAttr": "DN",
        "groupAttr": "member"
      }
    ],
    "nameAttr": "cn"
  }
}

Explicit Binding

...

Example of provider configuration file udmg-ldap-config.json for explicit binding on the LDAP server.

Code Block
language text
{ "host": "localhostldap:1389", "bindDN": "cn=proxy,ou=users,dc=stonebranch,dc=com", "bindPW": "proxy_password", "insecureNoSSL": true, "usernamePrompt": "Email Address", "userSearch": { "baseDN": "dc=stonebranch,dc=com", "filter": "(objectClass=*)", "username": "uid", "idAttr": "uidNumber", "emailAttr": "uidNumber", "nameAttr": "cn" }, "groupSearch": { "baseDN": "ou=users,dc=stonebranch,dc=com", "filter": "(objectClass=groupOfNames)", "userMatchers": [{ "userAttr": "DN", "groupAttr": "member" }], "nameAttr": "cn" } }

...