Configure LDAP for an organization

LDAP (Lightweight Directory Access Protocol) is configured in the Managment Console.

To completely configure access to Codar, you must configure LDAP to

• Authenticate a user's credentials
• Allow an organization to authenticate a user's access to information
• Allow an organization to authorize a user's access to information

From this page you can:

• Configure LDAP for authentication to log in to Codar.
• Configure LDAP for access control in Codar.

When you configure LDAP for the provider organization, you are configuring the set of users who can log in and be authenticated to perform actions in the Managment Console.

To configure authorization to access information in Codar for organizations, see Organization access control.

To configure LDAP

1. In the organization's navigation frame, select LDAP.

2. Provide or update the following information:

   LDAP Server Information

   Configure the LDAP server and a user with access to the server.

   Item	Description
   Hostname	The fully-qualified LDAP server domain name (server.domain.com) or IP address. Example: ldap.xyz.com
   Port	The port used to connect to the LDAP server (by default, 389). Example: 389
   Connection Security	If the LDAP server is configured to require ldaps (LDAP over SSL), select the SSL checkbox.
   Base DN	Base distinguished name. The Base DN is the top level of the LDAP directory that is used as the basis of a search. Example: o=xyz.com
   User ID (Full DN)	The fully distinguished name of any user with authentication rights to the LDAP server. If the LDAP server does not require a User ID or password for authentication, this value can be omitted. Example: uid=admin@xyz.com,ou=People,o=xyz.com
   Password	Password of the User ID. If the LDAP server does not reacquire a User ID or password for authentication, this value can be omitted.

   LDAP Attributes

   Enter the names of the attributes whose values are used for email notifications and authentication.

   Item	Description
   User Email	The name of the attribute of a user object that designates the email address of the user. The email address is used for notifications. If a value for this attribute does not exist for a user, the user does not receive email notifications. Default: mail
   Group Membership	The name of the attribute(s) of a group object that identifies a user as belonging to the group. If multiple attributes convey group membership, the attribute names should be separated by a comma. Default: member,uniqueMember
   Manager Identifier	The name of the attribute of a user object that identifies the manager of the user. Default: manager
   Manager Identifier Value	The name of the attribute of a user object that describes the value of the Manager Identifier's attribute. For example, if the value of the Manager Identifier attribute is a distinguished name (such as cn=John Smith, ou=People, o=xyz.com) then the value of this field could be dn (distinguished name). Or, if the Manager Identifier is an email address (such as admin@xyz.com) then the value of this field could be email. Default: dn
   User Avatar	LDAP attribute whose value is the URL to a user avatar image that will display for the user. If no avatar is specified, a default avatar will be used.

   User Information

   Codar uses a user search-based log-in method to authenticate access to information.

   Item	Description
   User Name Attribute	The name of the attribute of a user object that contains the user name that will be used to log in. The value for this field can be determined by looking at one or more user objects in the LDAP directory to determine which attribute consistently contains a unique user name. Often, you will want a User Name Attribute whose value in a user object is an email address. Examples: userPrincipalName or sAMAccountName or uid
   User Search Base	The location in the LDAP directory where users' records are located. This location should be specified relative to the Base DN. If users are not located in a common directory under the Base DN, leave this field blank. Examples: cn=Users or ou=People
   User Search Filter	Specifies the general form of the LDAP query used to identify users during login. It must include the pattern {0}, which represents the user name entered by the user when logging in. The filter is generally of the form <attribute>= 0}, with <attribute> typically corresponding to the value entered for User Name Attribute. Examples: userPrincipalName={0} or sAMAccountName={0} or uid={0}
   Search Option (Search Subtree)	When a user logs in, the LDAP directory is queried to find the user’s account. The Search Subtree setting controls the depth of the search under User Search Base. If you want to search for a matching user in the User Search Base and all subtrees under the User Search Base, leave Search Subtree selected. If you want to restrict the search for a matching user to only the User Search Base, excluding any subtrees, unselect Search Subtree.

3. Click Save.

Example LDIF content record

The following is a sample LDIF (LDAP Data Interchange Format) content record that shows the uniqueMember group membership attribute being used to define users cn=User1,ou=providers,ou=users,ou=system and cn=Manager1,ou=managers,ou=users,ou=system as members of the group cn=ResourceSupplyManagers,ou=providergrp,ou=groups,ou=system.

dn: cn=ResourceSupplyManagers,ou=providergrp,ou=groups,ou=system
objectclass: groupOfUniqueNames
objectclass: top
cn: ResourceSupplyManagers
uniqueMember: cn=User1,ou=providers,ou=users,ou=system
uniqueMember: cn=Manager1,ou=managers,ou=users,ou=system

To assign this group or DN to the Resource Supply Manager Role, go to the Access Control section of the Organizations area and add the cn=ResourceSupplyManagers,ou=providergrp,ou=groups,ou=system DN to the Resource Supply Manager role.