Prepare LDAP for Codar

Codar supports limited authentication out-of-the-box and has a fixed set of user names (and associated passwords) that can be used to log in. This basic form of authentication can be used for initial setup and experimentation with the product, but in a production environment, authentication should be configured to occur against a directory service.

Codar can be configured to authenticate against a Lightweight Directory Access Protocol (LDAP) server. Users can then log in with a pre-existing user name (such as an enterprise email address) and password combination. LDAP authenticates the login credentials by verifying that the user name and password match an existing user in the LDAP directory.

In Codar, LDAP is used to:

  • Authenticate a user's login to the Codar Console.
  • Authenticate a user's access to information.
  • Authorize a user's access to information.
  • Add user access control functionalities.
  • Add users or a group from LDAP to a design for access control.

These functions are configured when you configure LDAP and access control for an organization.

Before you configure LDAP for the Codar Console, you should be familiar with your enterprise LDAP server and LDAP configuration tasks.

Note The user object configured in LDAP that is used to log in to Codar and by which users can be identified should be configured to contain the following attribute types:

  • User Email - Required. This attribute type designates the email address of the user who is to receive email notifications. Common LDAP attribute names for email include mail, email, and userPrincipalName. If the value for this attribute in the user object in LDAP is empty or not valid, the user for whom the value is empty or not valid does not receive email notifications.
  • Group Membership - Required. This attribute type identifies a user as belonging to the group. Common LDAP attribute names that convey group membership include member and uniqueMember.

    The attribute names configured in your LDAP directory for these attribute types are used when configuring an organization's LDAP in the Codar Console

Note Do not create users in your LDAP directory that match the out-of-the-box users provided by  Codar (the out-of-the-box users are admin, csaInboundUser, csaCatalogAggregationTransportUser, csaReportingUser, csaTransportUser, idmTransportUser, ooInboundUser, and codarintegrationUser). Creating the same users in LDAP may allow the out-of-the-box users unintended access to the Codar Console or give the LDAP users unintended privileges.