Enportal/5.5/admin/user administration/ldap configuration - Revision history

imported>Jason.nicholls: /* Legacy LDAP Servers */

2015-04-23T07:13:08Z

Legacy LDAP Servers

← Older revision		Revision as of 07:13, 23 April 2015
Line 202:		Line 202:
	\|}		\|}

	==== Legacy LDAP Servers ====		==== Note on Case Sensitivity ====

			enPortal accounts are case sensitive, however most LDAP searches for usernames are case '''in-sensitive''' depending on the LDAP schema. As a result it may be possible for a user to end up with multiple enPortal accounts if they log in using different case. Having duplicate enPortal accounts may also result in some issues with LDAP Role Adapters.

			Therefore it is recommended to normalize the account names used by enPortal to ensure consistency. This can be accomplished using a custom login page to convert usernames entered to all lowercase or uppercase. Refer to the [[enportal/5.5/admin/system_administration/System_Settings#System_Login_Page\|System Login Page]] documentation for more information.

			==== Note on Legacy LDAP Servers ====

	Some older LDAP servers do not support the password policy controls. These are marked as ''Legacy'' in the table of supported LDAP servers above. For these directory servers it's necessary to disable policy control for them to work correctly:		Some older LDAP servers do not support the password policy controls. These are marked as ''Legacy'' in the table of supported LDAP servers above. For these directory servers it's necessary to disable policy control for them to work correctly:

imported>Doug yeager: /* LDAP Role Adapters */

2014-10-08T03:26:54Z

LDAP Role Adapters

← Older revision		Revision as of 03:26, 8 October 2014
Line 92:		Line 92:
	=== LDAP Role Adapters ===		=== LDAP Role Adapters ===

	LDAP Role Adapters are used to map groups to roles and user group memberships to role assignments ~~within enPortal~~. To create a new LDAP Role Adapter right-click on the ldap repository to be used and select ''New Role Adapter''. To edit an existing adapter, right-click on the adapter and select ''Edit Adapter''. Make sure to click the ''Save'' button when complete.		LDAP Role Adapters are used to map LDAP groups to enPortal roles and LDAP user group memberships to enPortal role assignments. To create a new LDAP Role Adapter right-click on the ldap repository to be used and select ''New Role Adapter''. To edit an existing adapter, right-click on the adapter and select ''Edit Adapter''. Make sure to click the ''Save'' button when complete.

	{\|class="wikitable"		{\|class="wikitable"

imported>Doug yeager: /* LDAP Role Adapters */

2014-10-08T03:25:53Z

LDAP Role Adapters

← Older revision		Revision as of 03:25, 8 October 2014
Line 92:		Line 92:
	=== LDAP Role Adapters ===		=== LDAP Role Adapters ===

	LDAP Role Adapters are used to map ~~users~~ to roles within enPortal. To create a new LDAP Role Adapter right-click on the ldap repository to be used and select ''New Role Adapter''. To edit an existing adapter, right-click on the adapter and select ''Edit Adapter''. Make sure to click the ''Save'' button when complete.		LDAP Role Adapters are used to map groups to roles and user group memberships to role assignments within enPortal. To create a new LDAP Role Adapter right-click on the ldap repository to be used and select ''New Role Adapter''. To edit an existing adapter, right-click on the adapter and select ''Edit Adapter''. Make sure to click the ''Save'' button when complete.

	{\|class="wikitable"		{\|class="wikitable"

imported>Jason.nicholls: /* Supported LDAP Servers */

2014-10-07T16:25:55Z

Supported LDAP Servers

← Older revision		Revision as of 16:25, 7 October 2014
Line 11:		Line 11:
	== Supported LDAP Servers ==		== Supported LDAP Servers ==

	{{Note\|This table represents known working information, however any LDAP directory service should work. Please let support know if you have a working configuration or issues with a directory service not listed ~~above~~.}}		{{Note\|This table represents known working information, however any LDAP directory service should work. Please let support know if you have a working configuration or issues with a directory service not listed.}}

	{\|class="wikitable"		{\|class="wikitable"

imported>Jason.nicholls: /* Supported LDAP Servers */

2014-10-07T16:20:04Z

Supported LDAP Servers

← Older revision		Revision as of 16:20, 7 October 2014
Line 39:		Line 39:
	\| replaced by Sun Java System Directory Server		\| replaced by Sun Java System Directory Server
	\|}		\|}
	<tt>*</tt> For enPortal to support password changes the appropriate ''pluggable authenticator'' needs to be configured on the LDAP Domain Adapter~~. See the documentation on the domain adapter further down for more information~~.		<tt>*</tt> For enPortal to support password changes the appropriate ''pluggable authenticator'' needs to be configured on the LDAP Domain Adapter.

	== Managing LDAP ==		== Managing LDAP ==

imported>Jason.nicholls: /* Automated Syncing */

2014-10-07T16:13:41Z

Automated Syncing

← Older revision		Revision as of 16:13, 7 October 2014
Line 239:		Line 239:
	# Perform a role-only sync for all repositories:<br><tt>/enportal/servlet/pd/vdir/system/LDAPSync?Submit=true&roles=on&syncAction=u&repositories=</tt>		# Perform a role-only sync for all repositories:<br><tt>/enportal/servlet/pd/vdir/system/LDAPSync?Submit=true&roles=on&syncAction=u&repositories=</tt>
	# Perform role and user sync for only the "myLDAP" repository:<br><tt>/enportal/servlet/pd/vdir/system/LDAPSync?Submit=true&syncAction=u&repositories=myLDAP</tt>		# Perform role and user sync for only the "myLDAP" repository:<br><tt>/enportal/servlet/pd/vdir/system/LDAPSync?Submit=true&syncAction=u&repositories=myLDAP</tt>
	# End-to-end example with authentication and role-only sync using <tt>curl</tt>:<br><tt>curl -c cookies.txt -o out.txt "http://localhost:8080/enportal/servlet/pd/?login=yes&userid=administrator&password=administrator&domainSelect=System"<br>curl -b cookies.txt -o out.txt "http://localhost:8080/enportal/servlet/pd/vdir/system/LDAPSync?Submit=true&roles=on&syncAction=u&repositories="</tt>		# End-to-end example with authentication and role-only sync using <tt>curl</tt>:<br><tt>$ curl -c cookies.txt -o out.txt <nowiki>"http://localhost:8080/enportal/servlet/pd/?login=yes&userid=administrator&password=administrator&domainSelect=System"</nowiki><br>$ curl -b cookies.txt -o out.txt <nowiki>"http://localhost:8080/enportal/servlet/pd/vdir/system/LDAPSync?Submit=true&roles=on&syncAction=u&repositories="</nowiki></tt>

	==== Directory Server Limits ====		==== Directory Server Limits ====

imported>Jason.nicholls: /* Automated Syncing */

2014-10-07T16:11:30Z

Automated Syncing

← Older revision		Revision as of 16:11, 7 October 2014
Line 239:		Line 239:
	# Perform a role-only sync for all repositories:<br><tt>/enportal/servlet/pd/vdir/system/LDAPSync?Submit=true&roles=on&syncAction=u&repositories=</tt>		# Perform a role-only sync for all repositories:<br><tt>/enportal/servlet/pd/vdir/system/LDAPSync?Submit=true&roles=on&syncAction=u&repositories=</tt>
	# Perform role and user sync for only the "myLDAP" repository:<br><tt>/enportal/servlet/pd/vdir/system/LDAPSync?Submit=true&syncAction=u&repositories=myLDAP</tt>		# Perform role and user sync for only the "myLDAP" repository:<br><tt>/enportal/servlet/pd/vdir/system/LDAPSync?Submit=true&syncAction=u&repositories=myLDAP</tt>
			# End-to-end example with authentication and role-only sync using <tt>curl</tt>:<br><tt>curl -c cookies.txt -o out.txt "http://localhost:8080/enportal/servlet/pd/?login=yes&userid=administrator&password=administrator&domainSelect=System"<br>curl -b cookies.txt -o out.txt "http://localhost:8080/enportal/servlet/pd/vdir/system/LDAPSync?Submit=true&roles=on&syncAction=u&repositories="</tt>

	==== Directory Server Limits ====		==== Directory Server Limits ====

imported>Jason.nicholls: /* Automated Syncing */

2014-10-07T16:01:47Z

Automated Syncing

← Older revision		Revision as of 16:01, 7 October 2014
Line 232:		Line 232:
	* base URL: <tt>/enportal/servlet/pd/vdir/system/LDAPSync?Submit=true</tt>		* base URL: <tt>/enportal/servlet/pd/vdir/system/LDAPSync?Submit=true</tt>
	* '''roles=on''': include this parameter to sync only roles.		* '''roles=on''': include this parameter to sync only roles.
	* '''syncAction=u''': set this to <tt>u</tt> for update, <tt>c</tt> for create, and <tt>d</tt> for delete.		* '''syncAction=''': set this to <tt>u</tt> for update, <tt>c</tt> for create, and <tt>d</tt> for delete.
	* '''repositories=''': set this to the LDAP Repository name to limit the sync to a specific repository.		* '''repositories=''': set this to the LDAP Repository name to limit the sync to a specific repository.

imported>Jason.nicholls: /* Automated Syncing */

2014-10-07T16:01:19Z

Automated Syncing

← Older revision		Revision as of 16:01, 7 October 2014
Line 238:		Line 238:

	# Perform a role-only sync for all repositories:<br><tt>/enportal/servlet/pd/vdir/system/LDAPSync?Submit=true&roles=on&syncAction=u&repositories=</tt>		# Perform a role-only sync for all repositories:<br><tt>/enportal/servlet/pd/vdir/system/LDAPSync?Submit=true&roles=on&syncAction=u&repositories=</tt>
	# Perform role and user sync for only the "myLDAP" repository:<br>/enportal/servlet/pd/vdir/system/LDAPSync?Submit=true&syncAction=u&repositories=myLDAP</tt>		# Perform role and user sync for only the "myLDAP" repository:<br><tt>/enportal/servlet/pd/vdir/system/LDAPSync?Submit=true&syncAction=u&repositories=myLDAP</tt>

	==== Directory Server Limits ====		==== Directory Server Limits ====

imported>Jason.nicholls: /* Automated Syncing */

2014-10-07T16:01:04Z

Automated Syncing

← Older revision		Revision as of 16:01, 7 October 2014
Line 228:		Line 228:
	==== Automated Syncing ====		==== Automated Syncing ====

	With lazy loading users are synchronized on-demand. However if using LDAP Role Adapters it's necessary to run LDAP Sync regularly to ensure enPortal matches the directory service. This process can be automated by triggering syncs through the web API. Please note for this to work a valid session must be established with enPortal first. Refer to the [[enportal/5.5/admin/accessing_enportal#Login_Credentials\|Accessing enPortal]] documentation for the information on authenticating via GET or POST.		With lazy loading users are synchronized on-demand. However if using LDAP Role Adapters it's necessary to run LDAP Sync regularly to ensure enPortal matches the directory service. This process can be automated by triggering syncs through the web API using a scheduled job (for example <tt>cron</tt> on Linux/UNIX systems). Please note for this to work a valid session must be established with enPortal first. Refer to the [[enportal/5.5/admin/accessing_enportal#Login_Credentials\|Accessing enPortal]] documentation for the information on authenticating via GET or POST.

	* base URL: <tt>/enportal/servlet/pd/vdir/system/LDAPSync?Submit=true</tt>		* base URL: <tt>/enportal/servlet/pd/vdir/system/LDAPSync?Submit=true</tt>