Skip to main content

## LDAP Authentication

On the Access > LDAP Authentication page you can configure LDAP Servers, Users and User Groups which can be used for login on the Web GUI.

By default the library has one predefined Administrator user account. After LDAP configuration has been completed, it is possible to either use specified users which were added under "LDAP Users" section or LDAP Users belonging to a group configured under "LDAP User Groups" section or the predefined Administrator account.

Each LDAP user or LDAP User Group is assigned to a role, based on the predefined user roles, and this role determines the access level for the LDAP user.

|  | Using LDAP does not disable the predefined user account. For library security, ensure that the password for the predefined administrator user account is always set. Setting the administrator password is required for any user with administrator role to log in from the Web GUI.

|  | LDAP server configuration is dependent on the company’s IT environment and security model. See your IT administrator for the settings for your environment. Before the wizard is used, you must know:

- Servers section:
  IP address or FQDN and port for the primary and backup LDAP servers
  Default Ports: 389 (LDAP) / 636 (LDAPS)
  These ports are used for requesting information from the local domain controller. LDAP requests sent to port 389/636 can be used to search for objects only within the global catalog’s home domain. However, the requesting application can obtain all of the attributes for those objects.
  Default Ports: 3268 (LDAP) / 3269 (LDAPS)
  These ports are used for queries specifically targeted for the Global Catalog. LDAP requests sent to port 3268/3269 can be used to search for objects in the entire forest. However, only the attributes marked for replication to the Global Catalog can be returned.
- Server Encryption section:
  If TLS is required for the LDAP server. This field is likely required for newer versions of LDAP servers. If TLS is checked it is also required to have the CA certificate available in PEM encoded format.
- Server Access section:
  Bind DN for the user who has access to the LDAP server (for example: CN=test,D=examplegroup,DC=local) and its corresponding password
- Distinguished Names section:

- User base DN. Parameters needed to search for potential library users on the LDAP server. For example, OU=Users,OU=RW,DC=libgroup,DC=local.
- Group base DN. Parameters needed to search for a group on the LDAP server. For example, OU=Groups,OU=RW,DC=libgroup,DC=local.

- Attribute Mapping section:

- For most Windows Active Directory environments, the Username field under Attribute Mapping should bet set to sAMAccountName.
- For most Windows Active Directory environments, the Group name field should bet set to cn.
- For most Windows Active Directory environments, the Group member field should bet set to uniqueMember.

- Filters (optional) section:
  Filters can be set as an optional parameters to only accessing users or groups with specific attribute configured in the filter. This filters can be configured for User and Group separately. For example, a filter (company=Example Company) will only provide access to users and/or groups which have this attribute set on the LDAP server directory.

Be ware that the fields besides the IP addresses or FQDN are case sensitive.

1. Navigate to the Access > LDAP Authentication page.
2. If not already listed, add your LDAP servers.

1. In the LDAP Servers area click Add Server.
   The Web GUI displays the Add Server dialog.
2. Enter all of the requested LDAP configuration settings in the corresponding area.
   See your LDAP server documentation or local LDAP administrator for the preferred values for the various LDAP configuration settings.

- Servers - IP address or FQDN for the LDAP primary and/or backup server and its port. The backup server is an optional parameter.
- Server Encryption - If TLS is required by your organization, select the checkbox and then paste the appropriate CA certificate (PEM encoded format).
- Server Access - Fill in the Bind DN and corresponding Bind password which is used only for querying the directory server and so this user must have privileges to search the directory.
- Distinguished Names - User base DN and Group base DN is required to search for users and groups on the LDAP server.
- Attribute Mapping - Provide the corresponding name of the attribute on the LDAP server which match to User name, Group name and Group member.
- Filters - Enter some filters is an optional configuration. It also to restrict access to users and/or groups which meet the configured filter.

1. Click Test Connection to verify the configuration.
2. When the library successfully connects to the LDAP server, click OK.

1. In the LDAP User area, click Add User.
   The Web GUI displays the Add User dialog.
2. Click Query LDAP Servers to see a list of available users.
3. Select the user name and then assign the user a role (Monitor, Superuser, Administrator or Service). Click OK

LDAP server settings can be modified after the server was added. Selecting a server from the server list and choose Modify Server from the LDAP Servers action menu, will open the Modify Server dialog. Modification is not possible when logged in with a user belonging to the server which is choosen to be modified.
Removing a server can be done by selecting the server which should be removed and choose Remove Server from the LDAP Servers action menu. This action must be confirmed. Removing is not possible when logged in with a user belonging to the server which is choosen to be deleted.

The user role of an LDAP user can be modified after the user has been added. This can be done by selecting the specific user and using the Modify User action from the LDAP User action menu.

Removing a user can be done by selecting the user which should be removed and choose Remove User from the LDAP Users action menu. This action must be confirmed.

The user role of an LDAP User Group can be modified after the group has been added. This can be done by selecting the specific group and using the Modify User Group action from the LDAP User Groups action menu.

Removing a User Group can be done by selecting the User Group which should be removed and choose Remove User Group from the LDAP Users Group action menu. This action must be confirmed.