LDAP authentication
In LDAP authentication the users log in with their credentials that are stored in an LDAP server. LDAP authentication is always turned on and requires some configuration to be made.
Configuration
LDAP Access
Property | Example | Description |
---|---|---|
TOKEN_SERVER_ADMIN_LDAP_SERVER_URLS | ldap://localhost:1389 | Space separated list of LDAP connect URLs. |
TOKEN_SERVER_ADMIN_LDAP_BASE_DN | dc=example,dc=com | Base DN of the LDAP server. Single value. |
TOKEN_SERVER_ADMIN_LDAP_BIND_DN | cn=Directory Manager | The bind user. This user is used to lookup subjects and group memberships in the LDAP. Single value. |
TOKEN_SERVER_ADMIN_LDAP_BIND_PWD | Admin123 | Password of the bind user. Single value. |
User search configuration
The following properties are needed to perform the user lookup in the above configured LDAP.
Property | Example | Description |
---|---|---|
TOKEN_SERVER_ADMIN_LDAP_USER_DNS | uid={0},ou=people | Semicolon separated list of LDAP user search DNs. Relative from base DN. The {0} maps to the username field in the login form. |
Group search configuration
Access to (parts of) the management interface is restricted to users with specific roles. These roles can be mapped to the group(s) they are member of in the LDAP. LDAP users that are not a member of the configured groups cannot get access to the management interface. At least one role must be mapped to a group to get access.
The following properties are needed to lookup the groups in the above configured LDAP.
Property | Example | Description |
---|---|---|
TOKEN_SERVER_ADMIN_LDAP_GROUP_SEARCH_SUBTREE | true | Boolean to indicate if groups can be searched in subtrees of the base. true or false |
TOKEN_SERVER_ADMIN_LDAP_GROUP_SEARCH_FILTER | uniqueMember={0} | LDAP group membership search filter. Single value. |
TOKEN_SERVER_ADMIN_LDAP_GROUP_SEARCH_BASE | ou=groups | LDAP group search DN. Single value, relative from the base DN. |
TOKEN_SERVER_ADMIN_LDAP_GROUP_SEARCH_GROUP_NAME_ATTRIBUTE | cn | Name attribute for the group. Single value. |