Articles in this section

[SPN9] Authentication - LDAP settings

  • Updated

Authentication settings

Expand the 'Authentication settings' menu to define user connection on SES8.

Authentication mode

Settings

Description

Local

User information is stored on SPN9

LDAP

Administrators do not have to create a SPN9 account for each user. Users can login via their corporate credentials, using LDAP protocol

SAML

Administrators do not have to create a SPN9 account for each user. Users can login via their corporate credentials, using SAML 2.0 protocol

 

LDAP settings

If LDAP is activated, Administrators can set a number of LDAP settings, including:

  • LDAP URL
  • LDAP search base
  • LDAP search filter
  • adminDN
  • Password for adminDN
  • Search attributes


LDAP mapping

In order to use LDAP on SPN9, it is necessary to map the attributes required to identify a user - Email, Given Name/First Name and Family Name - from the LDAP database to the server.

If LDAP is chosen as the authentication mode, administrators can set up a mapping to automatically create groups in SES from LDAP information.
This option can be configured via Administration > Settings > Authentication Settings > LDAP settings > LDAP Mapping > Mapping of groups.
In the config file, this mapping refers to DAP.Mapping.groups.

When the user logs on, the LDAP attribute containing the group names (usually 'memberOf') will be automatically imported as a SPN9 group and the user will be added to this group.

Notes:

  • Editing those LDAP imported groups in SES is not recommended, as they are modified on each login
  • User membership selection has been disabled for groups created from LDAP from the SES console group management page

 

Identifying LDAP settings

To find LDAP details, you can run the following queries from any member server on your Windows domain:

To find users:

dsquery user -name "John"

This will list all users who's name is John

 

To find details of a user and identify attributes names:

dsquery * "OU=John_Doe,DC=your,DC=domain,DC=com" -attr *