LDAP

KaDeck Web Enterprise has the option for an additional LDAP module.

Ldap Module license required

Make sure that your team has a Ldap Module license. Configuration of the module can take place without a license, but authentication of users is not possible.

Active Directory (AD) and OpenLDAP are supported. The group assignment is done via "memberOf" attributes. The group name is read via a Regular Expression from the Distinguished Name (DN) specification of the memberOf attributes.

LDAP is configured via the configuration parameters with the prefix xeotek_kadeck_authentication_ldap. To enable LDAP, xeotek_kadeck_authentication_method must be set from "internal" (no LDAP) to "ldap".

The UID of the user entity of the LDAP server is used as the user id in KaDeck. Additionally, an attribute for the full username can be specified using the xeotek_kadeck_authentication_ldap_user_fullname_attribute configuration parameter. The password of the user entity of the LDAP server is used.

Group assignment

Group assignments can optionally also be made via the LDAP server. The internal assignment of users to groups is then no longer possible and will be overwritten. In KaDeck, roles can also be assigned directly (without groups) to users. This function remains untouched when using the assignment of groups via LDAP. So roles can still be assigned directly to users in KaDeck.

Group assignment via LDAP is controlled via the configuration parameter xeotek_kadeck_authentication_ldap_group_management (boolean; false by default) and must be set to true.

The group assignment is done via "memberOf" attributes. The group name is read via a Regular Expression from the Distinguished Name (DN) specification of the memberOf attributes. The roles assigned directly to a user are only managed internally by KaDeck.

Login process & synchronization

When KaDeck is started, users are retrieved via the configured KaDeck system user (xeotek_kadeck_authentication_ldap_user, xeotek_kadeck_authentication_ldap_password) and created in KaDeck's database. Also, the mapping to the respective groups is generated if xeotek_kadeck_authentication_ldap_group_management is set to true.

KaDeck ignores group names that do not exist in KaDeck. Therefore, the groups should first be created in KaDeck when used for the first time and then KaDeck should be restarted with the LDAP configuration if the group assignment is to be done via LDAP.

As soon as a user wants to log in, the username and password are passed on to the configured LDAP server and the user information is retrieved with this user from the configured KaDeck base path xeotek_kadeck_authentication_ldap_base . If this is successful, it will be checked if the user already exists in KaDeck and created if not. Group assignments are not updated on login.

The user and group mappings are updated continuously. The synchronization interval can be set by configuring the xeotek_kadeck_authentication_ldap_sync_interval_mins parameter. The default setting is 60 (= 1 hour).

Newly added group assignments or removed group assignments will thus only become visible after the configured interval has elapsed or after a restart of KaDeck.

If there are not enough licenses for all users, the first n users will be activated in KaDeck in the order in which the users were created. Where n stands for the number of existing user licenses.

Debugging

To find errors in the configuration, the debug mode can be activated for the LdapAuthProvider. This will provide additional INFO log level information when retrieving users and creating users and group assignments.

To enable the debug mode set the xeotek_kadeck_authentication_ldap_debug parameter to true.

 

The full configuration list

Parameter

Description

Default value

xeotek_kadeck_authentication_method

Set to ldap to enable the LDAP module or use the internal authentication provider.

internal

xeotek_kadeck_authentication_ldap_url

The url of the LDAP server starting with ldap:// or ldaps://

 

xeotek_kadeck_authentication_ldap_user

The distinguished name (DN) of the KaDeck service user. Used to list users and their groups.

 

xeotek_kadeck_authentication_ldap_password

The password for the KaDeck service user.

 

xeotek_kadeck_authentication_ldap_debug

Output additional information for debugging purposes on log level INFO.

false

xeotek_kadeck_authentication_ldap_sync_interval_mins

The time interval at which KaDeck updates the users and their group memberships. The first update takes place immediately after the start of KaDeck.

60

xeotek_kadeck_authentication_ldap_base

The path to the KaDeck user accounts.

 

xeotek_kadeck_authentication_ldap_filter

The query filter for querying the user accounts found under the base path. KaDeck retrieves all users that match this filter.

(objectClass=person)

xeotek_kadeck_authentication_ldap_user_id_attribute

The attribute used for the userid in KaDeck (must be unique). This is the id that the user must enter when logging in.

cn

xeotek_kadeck_authentication_ldap_user_fullname_attribute

The attribute is used for the username in KaDeck. This is the displayed name of the user in KaDeck (when editing views for example). Uses the value of the user_id_attribute by default.

the configured user_id_attribute

xeotek_kadeck_authentication_ldap_group_attribute

The attribute is used to retrieve the user’s groups.

memberOf

xeotek_kadeck_authentication_ldap_group_regex

A regular expression used to extract the group name from the DNs/names listed under the group_attribute. Only the first matching group of the regular expression is used to match the KaDeck groups.

(?i)cn=(\w+),ou=Groups.*

xeotek_kadeck_authentication_ldap_group_management

Enables automatic group assignment of groups in KaDeck via the configured group_attribute. If not enabled, the groups have to be assigned to the users manually in KaDeck.

false

 

Default ports

Make sure that the ports are enabled for KaDeck Web.

389

TCP/ UDP

LDAP

636

TCP

LDAP over SSL

Was this article helpful?
1 out of 1 found this helpful

Comments

0 comments

Please sign in to leave a comment.