Open LDAP Auth Module
Open LDAP authentication module lets users log in to Space with credentials that are stored in an external directory service. This authentication module is pre-configured for Open LDAP. You can configure a module to use the standard LDAP scheme or LDAPS over SSL.
The Open LDAP authentication module does not import all of the user accounts from the directory service. Space only creates a user account when an unregistered user first logs in to Space.
When LDAP authentication is enabled, Space checks the directory service for each login attempt. Users who have been removed from the directory service cannot log in to Space.
Prerequisites
If you want to connect to the directory service over SSL, import the trusted SSL certificate for your Open LDAP service before you enable the authentication module. If there are any intermediate certificates that sit between the SSL certificate and the root CA certificate, you need to upload a file that contains the full certificate chain.
The option to import a trusted SSL certificate is not supported in the settings for the Open LDAP authentication module. Instead, you need to access the Trusted SSL Certificates page and import it there.
For more information, see Trusted SSL Certificates.
Enable Open LDAP Authentication
On the main menu, click
Administration and choose Auth Modules.Click New auth module. The New Auth Module dialog opens.
From the Type drop-down list, select Open LDAP.
In the New Auth Module dialog, enter values for the following settings:
Setting
Description
Status
Choose Active to enable the module.
Key
Give this authentication module a unique identifier.
Name
Give this authentication module a human-readable name to distinguish this module from other authentication modules in the Auth Modules list.
Server URL
Stores the LDAP URL of the directory service used to authenticate a login request in Space.
The LDAP URL uses the format
ldap://host:port/DN. Enter the full distinguished name (DN) of the directory where user accounts are stored.SSL keystore
Choose a custom SSL keystore for LDAPS connections.
Bind DN
Stores the value that is used to bind with the directory service.
Bind password
The password of the Bind account.
Filter
Stores an expression that locates the record for a specific user in the LDAP service. The substitution variable in the expression is replaced with the value entered as the username or email on the login page.
Connection timeout
Sets the period of time to wait to establish a connection to the authorization service. The default setting is 5000 milliseconds (5 seconds).
Read timeout
Sets the period of time to wait to read and retrieve user profile data from the authorization service. The default setting is 5000 milliseconds (5 seconds).
LDAP referral
Choose Follow to allow the authentication module to follow requests from the service to locate additional information in the LDAP directory.
User registration
On — Accounts in the Space organization will be created automatically for unregistered users who log in using Open LDAP authentication module.
Off — Open LDAP logins will be only available to users who already have an account in the Space organization.
Configure the Attribute Mapping.
When Space finds a record in the LDAP service that matches a filter, it fetches values from the LDAP attributes that are specified for each field and copies them to the user profile in Space. Use the following settings to define the filter criteria and map attributes that are stored in your directory service to user accounts in Space.
Field
Description
Login
Required. Maps to the LDAP attribute that stores the value to copy to the Login field in the Space profile. For Open LDAP, the default value is
uid.Full name
Maps to the LDAP attribute that stores the value to copy to the Full name field in the Space profile.
Email
Maps to the LDAP attribute that stores the value to copy to the Email field in the Space profile.
Groups
memberOf
Test the connection to your directory service
To verify that the Open LDAP authentication module is connected to your directory service, test the connection.
To test the connection:
Click the Test Login button.
In the Test Settings dialog, enter the credentials of a user who is stored in your Open LDAP service:
In the Login field, enter the
domainusername.In the Password field, enter the
password.
Click the Test Login button.
Space searches for the specified user account in the Open LDAP service. If the user is found, a success notification is displayed. If you get an error, check your user credentials and server URL.