LDAP Authentication Module

Prerequisites

If you want to authenticate over SSL, import the trusted SSL certificate and key store before you enable the authentication module. For more information, see SSL Certificates.

Enable LDAP Authentication

To allow users stored in a directory service to log in to YouTrack, enable an LDAP authentication module.

To enable LDAP authentication:

1. In the Access Management section of the Administration menu, select Auth Modules.

2. From the Add Module drop-down list, select the option that corresponds to the directory service you want to enable. You can select LDAP, OpenLDAP, or Active Directory.

   • The Add Module dialog opens.

     

3. In the Add Module dialog, enter values for the following settings:

   Field	Description
   Name	Enter a name for the authentication module.
   Server	Enter the server address of the directory service.
   Port	Enter the number of the port used to communicate with the directory service. The default port for standard LDAP is 389. The default port for LDAPS is 636.
   SSL	Select this option to authenticate over SSL.
   Search Base	Enter the domain components that define the top-level LDAP DN where user accounts are stored. For example, if your company uses the domain mycompany.com, enter the top-level LDAP DN dc=mycompany,dc=com. The value entered in this field is added to the LDAP URL and cannot contain unsafe characters. If you use organizational units to manage users, create separate auth modules for each organization. Include the organizational unit in the search base to create a unique LDAP URL for each module. LDAP authentication modules do not support recursive search in the LDAP tree.

4. Click the Create Module button.

   • The LDAP authentication module is enabled.

   • The Auth Modules page displays the settings for the LDAP authentication module. The module is pre-configured with standard settings that are based on the information you provided in the Add Module dialog. For additional information about the settings on this page, see Settings.

   

Test the Connection to your Directory Service

To verify that the LDAP authentication module is connected to your directory service, test the connection.

To test the connection:

1. Click the Test Login button.

2. In the Test Authentication dialog, enter the credentials of a user who is stored in your directory service:

   • In the Login field, enter the domainusername.

   • In the Password field, enter the password.

3. Click the Test Login button.

   • YouTrack searches for the specified user account in the directory service. If the user is found, a success notification is displayed. If you get an error, check your user credentials and server URL.

Settings

Use the following settings to configure how YouTrack connects to your directory service.

Bind Account Options

You can configure the module to perform the bind request with the LDAP service in one of two ways. The method used is determined by the option selected for the Bind account setting.

The value that you use for the Bind DN setting depends on the option that you select for the Bind account setting. Use the following guidelines to set the value for the Bind DN setting:

Attribute Mapping

When YouTrack finds a record in the LDAP service that matches a filter, it fetches values from the LDAP attributes that are specified for each field and copies them to corresponding Hub profile. Use the following settings to define the filter criteria and map attributes that are stored in your directory service to user accounts in YouTrack.

User Management Options

The following options are located at the bottom of the page. Use these settings to manage account creation and group membership.

Connection Settings

The settings in this section of the page let you reduce the loss of processing resources consumed by idle connections.

Sample Configurations

* replace company.com with the domain name of the Active Directory.