LDAP integration An LDAP integration allows your instance to use your existing LDAP server as the master source of user data. Administrators integrate with a Lightweight Directory Access Protocol (LDAP) directory to streamline the user login process and to automate administrative tasks such as creating users and assigning them roles. An LDAP integration allows the system to use your existing LDAP server as the master source of user data. Typically, an LDAP integration is also part of a single sign-on implementation. The integration uses the LDAP service account credentials to retrieve the user distinguished name (DN) from the LDAP server. Given the DN value for the user, the integration then rebinds with LDAP with the user's DN and password. The password that the user enters is contained entirely in the HTTPS session. The integration never stores LDAP passwords. The integration uses a read-only connection that never writes to the LDAP directory. The integration only queries for information, and then updates its internal database accordingly. Figure 1. Example LDAP Integration - User Import Note: For detailed information about setting up the integration, see LDAP integration setup. Note: If your instance is using an LDAP integration and the Active Directory settings require users to reset their password upon login, your users will not be able to log in the instance. The instance cannot change any user's active directory password. Aspects of LDAP integrationAdministrators integrate with a Lightweight Directory Access Protocol (LDAP) directory to streamline the user login process and automate administrative tasks such as user creation and role assignment. Features of LDAP integrationLDAP integration features include scheduled refresh, a dedicated listener, and on-demand login.LDAP integration requirementsReview the requirements for LDAP integration, which include a PKI certificate an LDAP compliant directory services server.LDAP configuration optionsThere are several optional add-ons you can consider when you configure LDAP.LDAP integration FAQsReview these frequently-asked questions about LDAP integration in the instance.LDAP integration setupAdministrators can enable LDAP integration to allow single sign-on of users from their company LDAP directory.LDAP import mapsLDAP import maps match fields in your LDAP database to fields in your instance. LDAP integration via MID ServerAdministrators can integrate using an LDAP data source over a Management, Instrumentation, and Discovery (MID) Server. LDAP integration troubleshootingIf you are integrating your LDAP server and have questions, these items may help you troubleshoot the issue. LDAP record synchronizationAdministrators can synchronize inactive, disabled, or deleted LDAP records with their LDAP records.Active Directory Application Mode (ADAM)Active Directory Application Mode (ADAM) is an Lightweight Directory Access Protocol (LDAP)-compliant directory service. Configure Microsoft Active Directory for secure LDAPS communicationUse certificate pairs to enable Microsoft Active Directory (AD) LDAPS communications.LDAP global catalog usage A DC can be granted the Global Catalog (GC) role. Global Catalog (GC) role is an LDAP-compliant directory consisting of a partial representation of every object from every domain within a forest. OpenLDAP minor schema modificationIn OpenLDAP 2.3 systems that use the back-bdb (Berkley backend), administrators make a minor modification to their schema to facilitate the integration.LDAP monitorThe LDAP monitor provides the current status of the LDAP servers and listener (starting with the Eureka release).Record LDAP deletionsBy default, the instance does not delete any entries after they disappear from LDAP.
LDAP integration An LDAP integration allows your instance to use your existing LDAP server as the master source of user data. Administrators integrate with a Lightweight Directory Access Protocol (LDAP) directory to streamline the user login process and to automate administrative tasks such as creating users and assigning them roles. An LDAP integration allows the system to use your existing LDAP server as the master source of user data. Typically, an LDAP integration is also part of a single sign-on implementation. The integration uses the LDAP service account credentials to retrieve the user distinguished name (DN) from the LDAP server. Given the DN value for the user, the integration then rebinds with LDAP with the user's DN and password. The password that the user enters is contained entirely in the HTTPS session. The integration never stores LDAP passwords. The integration uses a read-only connection that never writes to the LDAP directory. The integration only queries for information, and then updates its internal database accordingly. Figure 1. Example LDAP Integration - User Import Note: For detailed information about setting up the integration, see LDAP integration setup. Note: If your instance is using an LDAP integration and the Active Directory settings require users to reset their password upon login, your users will not be able to log in the instance. The instance cannot change any user's active directory password. Aspects of LDAP integrationAdministrators integrate with a Lightweight Directory Access Protocol (LDAP) directory to streamline the user login process and automate administrative tasks such as user creation and role assignment. Features of LDAP integrationLDAP integration features include scheduled refresh, a dedicated listener, and on-demand login.LDAP integration requirementsReview the requirements for LDAP integration, which include a PKI certificate an LDAP compliant directory services server.LDAP configuration optionsThere are several optional add-ons you can consider when you configure LDAP.LDAP integration FAQsReview these frequently-asked questions about LDAP integration in the instance.LDAP integration setupAdministrators can enable LDAP integration to allow single sign-on of users from their company LDAP directory.LDAP import mapsLDAP import maps match fields in your LDAP database to fields in your instance. LDAP integration via MID ServerAdministrators can integrate using an LDAP data source over a Management, Instrumentation, and Discovery (MID) Server. LDAP integration troubleshootingIf you are integrating your LDAP server and have questions, these items may help you troubleshoot the issue. LDAP record synchronizationAdministrators can synchronize inactive, disabled, or deleted LDAP records with their LDAP records.Active Directory Application Mode (ADAM)Active Directory Application Mode (ADAM) is an Lightweight Directory Access Protocol (LDAP)-compliant directory service. Configure Microsoft Active Directory for secure LDAPS communicationUse certificate pairs to enable Microsoft Active Directory (AD) LDAPS communications.LDAP global catalog usage A DC can be granted the Global Catalog (GC) role. Global Catalog (GC) role is an LDAP-compliant directory consisting of a partial representation of every object from every domain within a forest. OpenLDAP minor schema modificationIn OpenLDAP 2.3 systems that use the back-bdb (Berkley backend), administrators make a minor modification to their schema to facilitate the integration.LDAP monitorThe LDAP monitor provides the current status of the LDAP servers and listener (starting with the Eureka release).Record LDAP deletionsBy default, the instance does not delete any entries after they disappear from LDAP.
