LDAP Adapter

The LDAP adapter is used to establish a connection with Active Directory and OpenLDAP servers running LDAP Version 3.

Configuration Properties

For an LDAP-based system it becomes important to understand which groups a user belongs to when working on the user information. Especially in systems that implement RBAC, understanding the groups for a user is necessary for the authorization process. Fortunately, LDAP has the support for reverse membership mapping if the user and group objects use certain object classes. By default an OpenLDAP system uses the memberOf overlay; however, this default is overridden by the userMembershipAttribute property.

Spaces Not Recognized in LDAP Search Filters

Whitespaces between attribute assertions are not recognized and cannot be used in LDAP search filters.

This filter example will not work.

(| (&(objectClass=groupOfNames) (cn=UAT Power Users)) (&(objectClass=groupOfNames)(cn=QuickSight Members)) )

This filter example will work.

(|(&(objectClass=groupOfNames)(cn=UAT Power Users))(&(objectClass=groupOfNames)(cn=QuickSight Members)))

Active Directory Configuration

Use the following example for Active Directory configuration.

Sample Active Directory Configuration

{
    "id": "ldap",
    "type": "LDAP",
    "properties": {
        "domain": "example.itential.io",
        "url": "ldaps://example.itential.io:636",
        "bindUsername": "itential",
        "bindPassword": "itential-ldap-password",
        "baseDN": "dc=itential,dc=io",
        "baseGroupDN": "ou=groups,o=support,dc=itential,dc=io",
        "baseUserDN": "ou=people,o=support,dc=itential,dc=io",
        "groupSearchFilter": "(objectCategory=Group)",
        "userSearchFilter": "sAMAccountName",
        "userMembershipAttribute": "memberOf",
        "healthCheckInterval": 5000,
        "timeout": 5000,
        "connectTimeout": 5000,
        "idleTimeout": 5000,
        "timeLimit": 10,
        "reconnect": true,
        "activeDirectory": true,
        "tlsOptions": {
            "secureProtocol": "TLSv1_method",
            "requestCert": true,
            "rejectUnauthorized": true,
            "ca": "/etc/ssl/keys/activedirectory_ca.pem"
        },
        "customGroups" : [
         "Group1",
         "Group2"
        ]
    },
    "brokers": [ "aaa" ]
}

OpenLDAP Configuration

Use the following example for OpenLDAP configuration. The hostname in the URL must match the common name of the LDAP server certificate.

Sample OpenLDAP Configuration

{
    "id": "ldap",
    "type": "LDAP",
    "properties": {
        "domain": "uid={0},ou=people,o=support,dc=itential,dc=io",
        "url": "ldaps://example.pronghorn.io:636",
        "bindUsername": "cn=itential,ou=services,o=support,dc=itential,dc=io",
        "bindPassword": "itential-user-password",
        "baseDN": "dc=itential,dc=io",
        "baseGroupDN": "ou=groups,o=support,dc=itential,dc=io",
        "baseUserDN": "ou=people,o=support,dc=itential,dc=io",
        "groupSearchFilter": "(objectClass=groupOfNames)",
        "userSearchFilter": "uid",
        "userMembershipAttribute": "memberOf",
        "healthCheckInterval": 5000,
        "timeout": 5000,
        "connectTimeout": 5000,
        "idleTimeout": 5000,
        "timeLimit": 10,
        "reconnect": true,
        "activeDirectory": false,
        "tlsOptions": {
            "secureProtocol": "TLSv1_method",
            "requestCert": true,
            "rejectUnauthorized": true,
            "ca": "/etc/ssl/keys/openldap_ca.pem"
        }
    },
    "brokers": [ "aaa" ]
}

Adding Configurable Search Depth

The LDAP AAA Adapter includes a configurable Search Scope parameter. This feature enables users to control how deeply the adapter searches within the LDAP directory, ensuring optimal performance and precise query results. By setting the appropriate search scope, you can avoid overloading the LDAP server while retrieving the exact entries needed for authentication and authorization. Moreover, the Search Scope parameter may be used to avoid IAP from traversing more of the LDAP Directory tree than necessary, improving the performance or resource usage of a customer’s LDAP server.

Search Scope Options

The Search Scope defines the extent of the directory tree the LDAP adapter will query during a search operation. There are three options as referenced in the table below.

How to Configure Search Scope

To set the search scope, access the LDAP AAA Adapter Configuration view to update the Search Scope parameter.

1. Log in to the Itential Platform as administrator.
2. Navigate to the Admin Essentials → Adapters → LDAP AAA Adapter.
3. From the Configuration tab, locate the searchScope field in the Adapter settings.
4. Select the appropriate scope from the dropdown menu:
   • Base: For single-entry searches.
   • One: For searching immediate children.
   • Sub: For deep, recursive searches.
5. Click the Save icon at the top to retain your settings.

Figure: LDAP Adapter Search Scope Parameter

Search Scope Best Practices

• Choose the least expensive scope. Always use the most restrictive search scope for your use case.
• Use base when targeting a single known entry.
• Use one for organizational units with a manageable number of entries.
• Use sub (subtree) sparingly, especially in large directories.