Overview

LDAP Settings, which allow you to enable the LDAP bridge for both UNIX and Windows operating systems, are available through the user interface.

You can set up Universal Controller to use LDAP authentication for:

• Credentials for running tasks
• User logins

Credentials for Running Tasks Authentication

To use LDAP authentication for Universal Controller user credentials:

User Login Authentication

For information on how to access additional details - such as Metadata and complete database Details - for LDAP Settings (or any type of record), see Records.
 

LDAP Settings Field Descriptions

The following table describes the fields and buttons that display in the LDAP Settings.
 

Mappings Tab

The Mappings tab of the LDAP Settings page displays a list of Controller columns mapped to LDAP attributes.
 

Mappings Tab Column Descriptions

The following table describes the default columns displayed on the Mappings tab:

Mapping Details

To view the Mapping Details for a mapping on the list, click the Details icon next to that mapping.

For example:
 

Best Practices

The following best practices are provided to assist you in configuring LDAP.

Determining your User OUs and Group OUs

1. Determine which users/groups need to have access to Universal Controller.
2. Determine which Organizational Units (OUs) those users/groups belong to.
3. Build your list of user and group OUs.
 

Consider the following organizational units for required Users and Groups.

Users

Groups

You specify the User and Group Target OUs relative from the Base DN. In this case, the Base DN would be OU=Corporate,DC=stonebranch,DC=com.
 

For the User Target OU List LDAP Settings field, you would have the following entries:

For the Group Target OU List LDAP Settings field, you would have the following entries:

Customizing Users and Groups Lists to see DN of LDAP Synchronized Users and Groups

For each User and Group object in the LDAP directory that matches the configured search and OU configuration in Universal Controller, a User and Group record are created in the Controller to represent those objects.

For each User and Group record in the Controller that represents a synchronized LDAP User or Group, the Source column on the Users list or Groups List, respectively, contains the Distinguished Name of that User or Group in LDAP. (For Users and Groups created locally in the Controller, the Source column is blank.)

For example:

LDAP Server Operations

If LDAP is configured for Universal Controller, it refreshes every 24 hours.

Additionally, the Controller provides two Server Operations that let you force an LDAP refresh:

• LDAP Refresh (Asynchronous)
  This server operation performs an LDAP refresh in the background and sends entries to the Universal Controller log.
• LDAP Refresh
  This server operation perform an LDAP refresh that writes all log entries to the user interface as well as to the log, and prevents all other user activity while the process is running. If you estimate the refresh could take a considerable amount of time, we recommend you use the LDAP Refresh (Asynchronous) server operation.

LDAP Settings Fields

The following Best Practices should be followed for specific fields in the LDAP Settings.

URL

To avoid an inadvertent synchronization of LDAP using an incomplete LDAP configuration, refrain from providing a value for this setting until LDAP configuration has been completed.

Once LDAP configuration has been completed, you can utilize the LDAP Refresh server operation to verify your configuration.

Base DN

All directory searches are relative from the base object defined by the specified DN. The Base DN (or search entry point) should be the lowest base object in the directory for which both the User and Group OUs can be searched from.

User Filter

This setting defines which objects the Controller considers as Users when it queries objects in the configured User OUs (see pointers on configuring User OUs).

By default, the server will use filter (&(objectClass=user)(objectCategory=person)).
 

You can synchronize Users that belong only to a specific Group, such as one created for Unversal Controller.

For example:

CN=UnvControllerGroup,OU=CorporateGroups,OU=Corporate,DC=stonebranch,DC=com
 

To ensure that only Users belonging to UnvControllerGroup are synchronized, modify the recommended minimum user search filter:

(&(objectClass=user)(objectCategory=person)(memberOf=CN=UnvControllerGroup,OU=CorporateGroups,OU=Corporate,DC=stonebranch,DC=com))
 

You can synchronize Users that belong any Group that is a descendant of UnvControllerGroup.

For example:

• UnvControllerGroupA is a member of UnvControllerGroup.
• UnvControllerGroupB is a member of UnvControllerGroupA.
• UnvControllerGroupC is a member of UnvControllerGroupB.

To achieve this in AD, modify the search filter used to synchronize users that belong only to a specific Group:

(&(objectClass=user)(objectCategory=person)(memberOf:1.2.840.113556.1.4.1941:=CN=UnvControllerGroup,OU=CorporateGroups,OU=Corporate,DC=stonebranch,DC=com)))

Essentially, replacing memberOf with memberOf:1.2.840.113556.1.4.1941: will ensure that nested groups are considered.

1.2.840.113556.1.4.1941 (Matching rule OID) is a special "extended match operator" that walks the chain of ancestry in objects all the way to the root until it finds a match (see http://msdn.microsoft.com/en-us/library/windows/desktop/aa746475(v=vs.85).aspx).

Group Filter

This setting defines which objects the Controller considers as Groups when it queries objects in the configured Group OUs (see pointers on configuring Group OUs).

By default, the server will use filter (&(objectClass=group)(objectCategory=group)).

To limit the Groups synchronized from LDAP to a few specific Groups or Groups by name, adjust the Group search filter to include a query on the CN (common name) attribute.

For example, to synchronize a single group named CN=UnvControllerGroup,OU=CorporateGroups,OU=Corporate,DC=stonebranch,DC=com, modify the recommended minimum group search filter:

(&(objectClass=group)(objectCategory=group)(cn=UnvControllerGroup))
 

To synchronize only UnvControllerGroupA, UnvControllerGroupB, and UnvControllerGroupC, use the following filter:

(&(objectClass=group)(objectCategory=group)(|(cn=UnvControllerGroupA)(cn=UnvControllerGroupB)(cn=UnvControllerGroupC)))

To synchronize any Group that is a (direct) member of UnvControllerGroup, use the following search filter:

(&(objectClass=group)(objectCategory=group)(|(cn=UnvControllerGroup)(memberOf=CN=UnvControllerGroup,OU=CorporateGroups,OU=Corporate,DC=stonebranch,DC=com)))
 

To synchronize any Group that is a descendant of UnvControllerGroup (multi-nested groups), use the following search filter:

(&(objectClass=group)(objectCategory=group)(|(cn=UnvControllerGroup)(memberOf:1.2.840.113556.1.4.1941:=CN=UnvControllerGroup,OU=CorporateGroups,OU=Corporate,DC=stonebranch,DC=com)))
 

Essentially, replacing memberOf with memberOf:1.2.840.113556.1.4.1941: will ensure that nested groups are considered.

1.2.840.113556.1.4.1941 (matching rule OID) is a special "extended match operator" that walks the chain of ancestry in objects all the way to the root until it finds a match (see http://msdn.microsoft.com/en-us/library/windows/desktop/aa746475(v=vs.85).aspx).
 

If you do not want to synchronize Groups:

SSL/TLS Secured LDAP (LDAPS)

Universal Controller supports the use of LDAPS instead of the non-encrypted LDAP connection offered in the Controller.

It requires setting up a truststore (keystore) and setting the following properties in the Universal Controller Start-up Properties (uc.properties) file:

• uc.trustmanager.truststore
• uc.trustmanager.truststore.password

You must make sure that the LDAP server's certificate exists in the truststore that is referenced by these two properties.

When these configurations have been made, use ldaps:// for the URL prefix in the LDAP Settings Field Descriptions.