Configuring API Gateway to Use LDAP

Edit online

If your site uses Lightweight Directory Access Protocol (LDAP) for user and group information, you can configure webMethods API Gateway to obtain user and group information from the external directory.

LDAP protocols are designed to facilitate sharing information about resources on a network. Typically, they are used to store profile information (login ID, password, and so on.). You can also use them to store additional information. webMethods API Gateway uses LDAP for performing external authentication.

Using your existing LDAP information allows you to take advantage of a central repository of user and group information. System administrators can add and remove users from the central location. Users do not need to remember a separate password for webMethods applications; they can use the same user names and passwords that they use for other applications. Remember to use your LDAP tools to administer users or groups stored in an external directory.

To configure the server to use LDAP, you must:
  • Instruct webMethods API Gateway to use the LDAP protocol. webMethods API Gateway supports LDAP v3.
  • Define one or more configured LDAP servers that webMethods API Gateway is to use for these users.
  • Set the watt.server.ssl.trustStoreAlias property, if an LDAP provider is SSL-enabled, to point to the trusstore alias that contains the certificates required to establish a secure connection with the LDAP server.

To specify LDAP as the external provider

  1. Expand the menu options icon Menu options, in the title bar, and select User management.
  2. Click LDAP configuration.
  3. Under Provider select LDAP.
  4. Provide the following information:
    Field Description
    Cache size (number of users) Specifies the maximum number of LDAP users webMethods API Gateway can keep in memory in the user cache.

    The default value is 10.

    Once the limit is reached, webMethods API Gateway selects users for removal from the cache based on how long they have been idle. As a result, activity can extend the time a user remains in the cache.

    Credential time-to-live (minutes) Specifies the number of minutes an LDAP user's credentials (userid and password) can remain in the credential cache before being purged.

    The default is 60 minutes.

    When a user first attempts to log in, webMethods API Gateway creates a user object and checks the user's credentials against the LDAP directory. webMethods API Gateway stores the credentials so that subsequent requests to authenticate are made against the cached credentials, not the LDAP directory.

  5. Click Save.