LDAP Configuration
Overview
Simflofy offers both LDAP Authentication and LDAP Sync for standard LDAP Servers as well as Microsoft Active Directory
Setting up LDAP Authentication and Sync
In order to update LDAP properties, look in simflofy-admin/WEB-INF/classes/ldap_auth.properties
Active Directory
Active Directory authentication has different requirements, found here.
Admin User
When using LDAP or AD for authentication the default admin user will not be available. Be sure to have role mappings configured.
Authentication
| Property | Description | Default |
|---|---|---|
auth.ldap.url | The full url of your LDAP instance, including domain information | ldap://test.ldap.com:389/dc=auth,dc=myorg,dc=com |
auth.ldap.user.search.base | The base search name for individuals users | ou=users |
auth.ldap.user.search.filter | The filter used to find users, based on their login | (uid={0}) |
auth.ldap.group.search.base | The base search criteria for groups | ou=groups |
auth.ldap.group.search.filter | The filter used to search for users within a group | (uniquemember={0}) |
Role Mappings
The values can be comma delimited to map multiple groups to a role. Spaces are allowed
Simflofy Admin Roles
| Property | Role |
|---|---|
auth.ldap.adminGroupName | SIMFLOY_ADMIN |
auth.ldap.orgAdminGroupName | ORG_ADMIN |
auth.ldap.managerGroupName | MANAGER |
auth.ldap.execGroupName | EXECUTOR |
auth.ldap.monitorGroupName | MONITOR |
auth.ldap.tsearchOnlyGroupName | TSEARCH |
TSearch Roles
| Property | Role |
|---|---|
auth.ldap.tsearchAdminGroupName | TSEARCH_ADMIN |
auth.ldap.tsearchUserGroupName | TSEARCH_USER |
auth.ldap.rmManagerGroupName | TSEARCH_RM_MANAGER |
auth.ldap.rmOfficerGroupName | TSEARCH_RM_OFFICER |
auth.ldap.rmUserGroupName | TSEARCH_RM_USER |
These values will be converted to the format"ROLE_(AUTHORITY)", which is the standard format for an authority.
These values are checked when authenticating to assign a role to a new user.
Ex. auth.ldap.adminGroupName=exampleAdmins will become ROLE_EXAMPLEADMINS
info
If an authority passed to the user mapper by the LDAP server does not begin with ROLE_, Simflofy will prepend it. Additionally, all authorities are converted to uppercase.
Examples
Map LDAP group to Simflofy Administrators
auth.ldap.adminGroupName=exampleAdmins
Map LDAP group to Simflofy Read-Only Users
auth.ldap.monitorGroupName=exampleUsers
These two properties should reflect the name of the groups in your directory server.
User Attributes
Additionally, you can set what attribute fields are checked to map users from your LDAP. Here are the properties and their defaults.
| Property | Description | Default |
|---|---|---|
auth.ldap.attr.uid | Required. The field that will become the user's login | uid |
auth.ldap.attr.fname | The user's first name | displayName |
auth.ldap.attr.lname | The user's last name | sn |
auth.ldap.attr.mail | The user's email address |
Group and User Sync
If you have groups and users you wish to automatically sync to Simflofy you can use the following configurations. They are set to their default values here
LDAP Sync is executed at startup and can be manually triggered or individual users or groups.
LDIF Requirements
This feature will only work if your LDAP groups contain the keys to their users.
| Property | Description | Default |
|---|---|---|
auth.ldap.userdn | The distinguished named of the authenticating user. Used if your LDAP requires authentication | |
auth.ldap.ldappass | The password for the authenticating user, if needed | |
auth.ldap.map.groups | Map groups as startup | false |
auth.ldap.map.users | Map users with their groups. Only occurs if mapping groups. | false |
auth.ldap.map.group.name.attribute | The name attribute of the ldap group. Will become the name of the user group, with "ldap:" prepended | ou |
auth.ldap.map.group.member.attribute | The attribute on the group used to denote a member. Will be used to gather user ids. | uniqueMember |
auth.ldap.map.group.class | The class of object to search for when looking for a group. | organizationalUnit |
auth.ldap.map.user.class | The class of object to search for when looking for a user | organizationalPerson |
auth.ldap.map.user.id.attribute | The id attribute for a user, which should represent their login name | uid |
auth.ldap.map.user.name.attribute | The attribute which represents the full distinguished named of the user, including domain and group. | cn |
auth.ldap.map.empty | Map groups that have no users. | false |
auth.ldap.map.exclude | A comma delimited list of group names to skip mapping Ex. (Group1,Group2,...) |
Re-syncing a user
LDAP users are marked as such in the database. In the Admin)Users page you will see the sync icon available next to LDAP users.
Multiple Roles
Simflofy does not support mapping the same groups to different roles and vice versa
Re-syncing a Group
Groups can be re-synced by editing them in the Admin > User Groups page.
Active Directory (3.1.1+)
Simflofy can also use Active Directory for authentication. In order to do so the following fields are required:
| Property | Description | Example Value |
|---|---|---|
auth.ldap.ad | Let's Simflofy know it's connecting to Active Directory | true |
auth.ldap.ad.domain | Your AD Domain | yourdomain.com |
auth.ldap.url | Your ldap url with port. Do not include any domain information | ldap://somehost:389 |
auth.ldap.attr.uid | Will become the user's login. The example value is the default field for Active Directory. | sAMAccountName |
auth.ldap.userdn | Active Directory always requires authentication to connect. Be sure the authenticating user has the authority to search | user@domain |
auth.ldap.ldappass | The authenticating user's password | mypassword |
Domain
The user does not need to supply the @domain during authentication
Active Directory Sync(3.1.1+)
In order to use the sync feature with Active Directory, the following fields must be populated. Their values for the default Active Directory configuration are included.
auth.ldap.map.user.id.attribute=sAMAccountName
auth.ldap.map.user.name.attribute=distinguishedName
auth.ldap.map.user.class=person
auth.ldap.map.groups.name.attribute=cn
auth.ldap.map.groups.member.attribute=member
auth.ldap.map.groups.class=group
LDAP Sync Order of operations
Search objectClass = auth.ldap.map.groups.class
Return group list by mapping names using auth.ldap.map.groups.name.attribute
Then, for each group name,
Check if a user group by that name exists. We add the ldap: prefix for sync groups.
Search for the group by name.
Extract a list of a members from the group using auth.ldap.map.groups.member.attribute
Search the ldap for that user with auth.ldap.map.user.name.attribute
Extract that user's uid using the auth.ldap.map.user.id.attribute
Add id to list of users
If mapping users, search for the user's authorities using their id.
Map the user to the Simflofy database using the mapping attributes above.
Set the new user list on the group, and save.