Enable LDAP Server

Toggle to enable/disable the LDAP server.

NOTE: Disabling the LDAP server will prevent the users of this LDAP server from logging into the system. It will still be possible to manually add users and map LDAP groups to roles.

Server name *

Enter the name of the LDAP server.

NOTE: This name that will also be used in the login page.

Host name *

Enter the LDAP server hostname

For example: ldap.company.com

Port *

Enter the LDAP server port

For example: 389, 636 (for SSL)

User name & Password *

Enter the credentials of the binding user (LDAP bind username and bind password).

NOTE: User needs at least read permissions to the LDAP directory.

The username can be in the following formats: <domain\username> or <username@domain> or <full user DN>

For example:  user@domain.name or cn=user,dc=domain,dc=name

Use SSL

Check this to connect to the LDAP server using SSL encryption

Verify SSL certificate

Check this to verify the SSL certificate.

NOTE: If you are using an untrusted certificate, you can cancel the verification of certificate to make the connection pass. SSL will still be used and the network will be encrypted.

Directory Type *

Select from the options: Active Directory, Open LDAP, Custom LDAP Server.

Server attributes are automatically populated according to default settings.

Enable SSO

NOTES:

• Only enabled for the ‘Active Directory’ directory type
• User login with Windows SSO does not require entering login credentials
• See Access Control - Preparing the Environment > Active Directory - LDAP SSO Configuration

Domain *

Select a Windows domain to map the LDAP server to.

NOTES:

• It is only possible to map domains which are not already mapped to an LDAP server
• Users not in this domain cannot login through Windows SSO (even though they are part of the LDAP server settings). They will be able to login with their LDAP username and password though.

Base DN *

The LDAP root node for searching users.

Additional User DN

Limits user search to specific DN (in order to optimize the search time). The additional user DN is appended to the base DN.

NOTE: Do not repeat the base DN in this field.

User Object Class *

The LDAP user object class type to use when loading users.

User Object Filter *

The filter expression to use when searching user objects.

Username Attribute *

The attribute field to use on the user object

User First Name Attribute *

The attribute field to use when loading the user’s first name.

User Last Name Attribute *

The attribute field to use when loading the user’s last name.

User Email Attribute *

The attribute field to use when loading the user’s email

Synchronization enabled/disabled

If synchronization is disabled, users will need to be created manually (via Import from Directory only), as there is no information about role and team in order to create them.

Enabling synchronization enables automatically creating new LDAP users who will be automatically assigned to roles and teams, according to their LDAP mapping.

NOTE: If synchronization is disabled, login can only be performed only using existing LDAP users. If synchronization is enabled, a user can easily login with only user name and password.

Enables defining the default role(s) and team(s) to be assigned to newly-created LDAP-based users.

Default Role & Default Team *

Define the default role and team that will be assigned to newly-created, LDAP-based users.

NOTE: A default team (but not a default role) must be selected when synchronization is enabled. In the Hierarchy tree, you can search for a specific team by any string contained within the team information (see Hierarchy Tree Team Search).

These defaults (for Role and Team) will be used in case no Advanced Team and Role Mapping were defined for a current user trying to login.

Automatically update user role and team upon login

If checked, a user’s role and team will be automatically updated upon login, according to default or Advanced Team and Role Mapping.

NOTE: If this feature is not checked, a user's personal details will only be updated once – at the first login.

Periodically sync user availability

Advanced Team and Role Mapping

Enables mapping roles and teams to LDAP groups.

Enables a user’s role to be automatically set according to specific LDAP group DNs. Enables the user to automatically be assigned to a team according to LDAP mapping configuration (see Access Control - Teams Tab >  LDAP Group Mapping).

Enables defining the search of LDAP groups that can be mapped to teams (see Access Control - Teams Tab >  LDAP Group Mapping).

Additional Group DN

[Optional]: The Additional Group DN (appended to the Base DN) reduces the search scope to a specific DN when searching for groups.

NOTE: Do not repeat the Base DN in this field.

Group Object Class

Used for team mapping, it defines the group object class, and limits group searching to a specific DN.

NOTE: Required if Synchronization and Advanced Team and Role Mapping are enabled.

Group Object Filter

Used for team mapping, Group Object Filter is an LDAP filter expression for use when searching groups.

NOTE: Required if Synchronization and Advanced Team and Role Mapping are enabled.

Group Name Attribute

Used for team mapping, Group Name Attribute is an attribute in LDAP defining a group’s name.

NOTE: Required if Synchronization and Advanced Team and Role Mapping are enabled.

Enables defining the attributes that associate the LDAP users with their assigned teams.

Group Members Attribute (member)

An LDAP member attribute which is multi-value, it contains a list of unique names for users in the team (user DNs), as well as group and contact objects that are members of the group.

It is used to determine the logged in user groups, in order to perform the right mapping to roles and teams.

NOTE: Required if Synchronization and Advanced Team and Role Mapping are enabled.

User Membership Attribute (memberOf)

An LDAP memberOf attribute which is multi-value, it contains all the groups that the current user is a member of (group DNs).

If designated, this attribute replaces the Group Members Attribute for determining the logged in user groups (taking the groups the user belongs to straight from the user entry, instead of searching inside every group).

Define what role(s) the users in specific LDAP group(s) will be assigned (mapped) to. Multiple roles can be assigned to the same LDAP Group DN.

1.     Click Edit Advanced Role Mapping.

2.     Click the arrow in the Cx Role field and then select a role from the options.

3.     In the LDAP Group DN field, use a semicolon to separate multiple group entries.

        Examples: cn=dev;ou=grp;dc=my;dc=org;cn=qa;ou=grp;dc=my;dc=org

4.     Repeat this procedure for each LDAP group—role mapping.

5.     Click Update.