[SPN9] Authentication - LDAP settings – SYSTRAN Support Center

Introduction

This KB describe:

LDAP settings are available from administration > Authentication settings > LDAP settings

You will find there general settings:

Setting	Description	Examples
LDAP URL*	Base URL to connect to your LDAP server	ldap://server:389 ldaps://server:636
LDAP search base*	Base object of your search	ou=people,dc=example,dc=com
LDAP search filter*	Criteria to use to select account. Token {{username}} will be replace by login.	(uid={{username}}) (sAMAccountName={{username}}) (userPrincipalName={{username}}) (&(mail={{username}}))
Search attributes*	List of all attributes retrieved	mail, givenName, sn, uid userPrincipalName, givenName, familyName, email
adminDN	Service account used to connect to LDAP	uid=systran-ldap-acccount,dc=example,dc=com
Password for adminDN	Password
TLS Options for LDAP server	Additional TLS options

LDAP Mapping settings:

Setting	Description	Examples
Mapping of identifier*	Attribute used as identifier. In most cases, this is login	uid userPrincipalName
Mapping of email*	Email attribute	mail
Mapping of given name*	First name attribute	givenName
Mapping of family name*	Last name attribute	familyName sn
Mapping of groups	Multi value attribute containing the list of groups attached to user	memberOf

Note that all mapped attributes should be present in the "Search attributes" list.

Groups filter

Setting	Description	Examples
Groups blacklist	Regular expression matching groups to exclude
Groups whitelist	Regular expression matching groups to keep and create	SYSTRAN

* Mandatory fields

More details about LDAP Group Mapping can be found here.

Note: if custom CA is required, you will have to update: /lib/systemd/system/systran-ses-console.service

Environment="NODE_EXTRA_CA_CERTS=[your CA certificate file path]"

And reload systemd deamons.

To activate LDAP, add it in the "Enabled authentication modes" list. LDAP logon screen will be available from https://server/auth/ldap

To set LDAP default authentication mechanism (when you connect to https://server), set "Default Authentication mode" to LDAP.

To activate or update setttings, restart console service.

To connect or identify LDAP settings, it could be useful:

To find users:

dsquery user -name "John"

This will list all users who's name is John

To find details of a user and identify attributes names:

dsquery * "OU=John_Doe,DC=your,DC=domain,DC=com" -attr *

Install ldapsearch

yum install openldap-clients

Then you can search:

ldapsearch -H ldap://server:389 -x -W -D "uid=systran-ldap-acccount,dc=example,dc=com" \
-b "ou=people,dc=example,dc=com" "(uid=John)"