Ldap Integration

Active Directory Application Mode (ADAM) is an Lightweight Directory Access Protocol (LDAP)-compliant directory service.

Use certificate pairs to enable Microsoft Active Directory (AD) LDAPS communications.

By default, the instance does not delete any entries after they disappear from LDAP.

All of the configurations for ADAMSync are stored in xml files.

Detect that an existing, current, user account is inactive or has been disabled or deleted from an Active Directory (AD) LDAP.

LDAP import maps match fields in your LDAP database to fields in your instance.

An LDAP integration allows your instance to use your existing LDAP server as the primary source of user data.

Administrators can enable LDAP integration to allow sign-on of users from their company LDAP directory.

If you are integrating your LDAP server and have questions, these items may help you troubleshoot the issue.

Administrators can integrate using an LDAP data source over a Management, Instrumentation, and Discovery (MID) Server.

Administrators can synchronize inactive, disabled, or deleted LDAP records with their LDAP records.

The transform map moves data from the import set table to the target table (User or Group).

ADAMSync is included with Windows Server 2003 R2. Download and install ADAMSync if you are using a different OS.

You may encounter issues in the following areas while integrating LDAP via MID Server.

Administrators use MS ADAMSync to populate LDAP directories that use MS ADAM.

All ADAM data can be backed up using standard file system backup methods.

Create custom transform maps, scripts, and business rules to specify requirements when importing data.

Once the OU structure is created, define the permission delegations to properly secure the objects to limited users.

The LDAP Log file lists industry standard error codes for both LDAP and Active Directory (AD).

Implement an LDAP extraction process to detect inactive users.

An LDAP integration allows your instance to use your existing LDAP server as the primary source of user data.

Review the requirements for LDAP integration, which include a PKI certificate an LDAP compliant directory services server.

Filters on the LDAP refresh process can be used to specify processing that ignores inserts of disabled users.

The following script examples assume you use an Active Directory (AD) for your LDAP server.

A DC can be granted the Global Catalog (GC) role. Global Catalog (GC) role is an LDAP-compliant directory consisting of a partial representation of every object from every domain within a forest.

In OpenLDAP 2.3 systems that use the back-bdb (Berkley backend), administrators make a minor modification to their schema to facilitate the integration.

ADAM Objects include User Objects, UserProxy Object, and Group Objects.

The system requires a user account to read the Active Directory Application Mode (ADAM) object information that is imported into the application instance.

The primary tool used for testing is LDP. This allows you to fully test user authentication.

The default configuration for userProxy object authentication is to enforce LDAPS (secure LDAP) communications. LDAPS requires SSL certificates to secure the network traffic.

Install an SSL certificate on the server and any LDAP client to support secure binds and encrypt the user and password information being transmitted.

You automatically provision users who are in the LDAP server but not yet in your instance.

Change or disable LDAP connection monitoring and notifications.

The first install copies the ADAM files to your computer, registers requires components, and creates the application shortcuts.

Each LDAP organizational unit (OU) definition has its own related list of data sources.

Logically group objects stored in ADAM into containers and organizational units (OU) just as they would be in Active Directory.

Create a new LDAP server record in the instance.

An organizational unit (OU) definition specifies the LDAP source directories available to the integration.

Define user accounts in ADAM. One user account is used for the instance to connect with and the other user account is for ADAMSync.

Enabling a listener is optional. If enabled, a listener notifies the system to process LDAP records soon after there is an update on the LDAP server.

LDAPS clients, including the instance need the public key certificate in order to make a secure connection to ADAM.

Export the public key certificate and import it into the application when you configure Microsoft Active Directory for SSL access.

Identify when an Active Directory (AD) user is deleted (or made inactive).

When you configure Microsoft Active Directory for SSL access, you must generate an internal certificate and request the external certificate.

As an administrator, you can import binary large object (BLOB) data with an LDAP integration through the MID Server.

Install the ADAM configuration file through the Windows command line.

Modify the OpenLDAP schema. These steps detail a schema modification to OpenLDAP 2.3 provided by one of our customers that helped them integrate with their instance.

An LDAP property is available to send a one-time password to a user if the user is unable to log in because the LDAP server is down. You can also configure another property to control how long the password is valid.

The LDAP transform map determines how fields in the Import Set table map to fields in existing tables such as Incident or User.

Set up the ADAM console. Even though there are many similarities between ADAM and Active Directory, the administration can be very different since there is no Users and Computers management console.

The first step to configure Microsoft Active Directory for SSL access is to set up a stand-alone Certificate Authority (CA).

Specify the attributes included in LDAP server queries by using the LDAP server Attributes field. This can enhance performance as well as security.

The instance tests the connection automatically every time a user opens the LDAP Server form. Alternatively, you can manually test the connection to the LDAP server from the LDAP server form.

Test the LDAPS connections. There are two console connections, one for Local Computer Certificates, and the other for Local Computer Services Certificates on the new ADAM service.

Test the LDAPS connectivity after installing the internal and third party certificates when you configure Microsoft Active Directory for SSL access.

You can install an X.509 certificate for your LDAP integration.

After creating an LDAP transform map, refresh the LDAP data to verify the transform map works as expected.

You can view current information about LDAP servers and listeners using LDAP monitor.