LDAP configuration properties

simple

The basic LDAP authentication mechanism requiring the user name and password to be passed over the wire unencrypted. You may be able to add SSL for secure access, otherwise this should only be used for testing.

DIGEST-MD5

More secure RFC 2831 Digest Authentication. Note that with Active Directory, this requires your user accounts to be set up with reversible encryption, not the default setting.

If set to an empty string (the default for the ldap subsystem), an LDAP query involving ldap.synchronization.personQuery and ldap.synchronization.userIdAttributeName will be performed to resolve the DN from the user ID dynamically. This allows directories to be structured and does not require the user ID to appear in the DN.

If set to a non-empty value, the substring %s in this value will be replaced with the entered user ID to produce the ID passed to LDAP. This restricts LDAP user names to a fixed format. The recommended format of this value depends on your LDAP server.

Active Directory

There are two alternatives:

User Principal Name (UPN)

These are generally in the format of <sAMAccountName>@<UPN Suffix>. If you are unsure of the correct suffix to use, use an LDAP browser, such as Softerra, to browse to a user account and find its userPrincipalName attribute. For example:

%s@domain

DN

This requires the user to authenticate with part of their DN, so may require use of their common name (CN) rather than their login ID. It also may not work with structured directory layouts containing multiple organization units (OUs). For example:

cn=%s,ou=xyz,dc=domain

OpenLDAP

The format used depends on the value chosen for ldap.authentication.java.naming.security.authentication.

simple

This must be a DN and would be something like the following:

uid=%s,ou=People,dc=company,dc=com

DIGEST-MD5

Use this value to pass through the entered value as-is:

%s

When authenticating against LDAP, users are not always in the same subtree of LDAP. In this situation, it is necessary to support authentication against multiple branches of LDAP. For example, some users who can authenticate using cn=%s,ou=myCity,ou=myState,o=myCompany but others can authenticate using cn=%s,ou=ANOTHERCity,ou=myState,o=myCompany. Set ldap.authentication.userNameFormat to be empty (the default), and then it will derive a query from your personQuery to look up a user by UID. This ensures that you can support users in any branch structure.

If you already have a group of administrators in LDAP, you can add the required LDAP group(s)to the SkyVault_ADMINISTRATORS group. This can be set without a server restart.

none

Use this option if your LDAP server supports connection without a password. Set to none to allow synchronization via anonymous bind (Note that you will not also need to set the following two properties). 

simple

This option is the basic LDAP authentication mechanism requiring the user name and password to be passed over the wire unencrypted. You may be able to add SSL for secure access; otherwise, use this option for testing only.

DIGEST-MD5

This option provides a more secure [ftp://ftp.isi.edu/in-notes/rfc2831.txt RFC 2831] digest authentication. With Active Directory, this requires your user accounts to be set up with reversible encryption, not the default setting.

This is the default principal to use (only used for LDAP sync when ldap.synchronization.java.naming.security.authentication=simple): ldap.synchronization.java.naming.security.principal=cn\=Manager,dc\=company,dc\=com 

Active Directory

yyyyMMddHHmmss'.0Z'

OpenLDAP

yyyyMMddHHmmss'Z'