JMap LDAP user manager
Dernière mise à jour
English
Dernière mise à jour
You can connect to any LDAP compliant directory (in read-only mode). Unix, Linux and Windows systems offer many LDAP compliant directories.
In order for the JMap LDAP user manager option to be available in the User manager tab of the Users / Groups section in JMap Admin, you must include the following line in the JMAP_HOME/conf/jmapserver.properties file:
usermanager.ldap=com.kheops.jmap.server.security.LDAPUserManager
We recommend you use the instead of simply using the LDAP user manager. This will allow you to maintain access to JMap Admin even if errors arise in the configuration of LDAP.
In the User manager section, select the Composite user manager and add the JMap LDAP user manager. A new interface opens, allowing you enter the settings to configure the connection to the LDAP server.
JMap LDAP user manager
Friendly name
Name used to easily identify the LDAP user manager.
Server URL
LDAP server address. You can add several LDAP servers by separating the addresses with a space.
Example:
ldap://host1 ldap://host2
where host1 and host2 are the URLs of the LDAP servers.
DN
Unique identifier (Distinguished Name) used to define the root of the directory. Includes a list of Domain Component entries.
Example:
dc=k2geospatial,dc=com
User
User name that will be used by JMap Server to connect to the LDAP directory. It is recommended to have a user created specifically for JMap purposes. This user’s password should never expire. The user name must be accompanied by the domain the user belongs to.
Example:
cn=admin,dc=k2geospatial,dc=com
Password
The user password that JMap Server will use to connect to the LDAP directory.
Admin. password
A user named administrator must always exist in JMap. If there is no administrator user in the LDAP directory, JMap will simulate one. In this case, you must provide the password associated with this user. If the administrator user exists in the LDAP directory and a password is entered, it will be ignored.
Use prefix and suffix
Select this option if the LDAP server uses a prefix and a suffix for user authentication.
Authentication prefix
Some LDAP servers require a prefix to be concatenated with the user name in order to proceed with authentication.
Example:
Prefix: a_domain\
User: a_user
Result: a_domain\a_user
Authentication suffix
Some LDAP servers require a suffix to be concatenated with the user name to proceed with authentication.
Example:
Suffix=@a_domain
User=a_user
Result: a_user@a_domain
User class
This setting and the ones that follow depend on the internal structure of the LDAP server, i.e. the way the users are organized into groups. This information is used to identify the LDAP users and groups. You must indicate the corresponding parameters in the LDAP server to which you connect. Name of the LDAP object class used to identify a user in the LDAP directory.
Group class
Name of the LDAP object class used to identify a group in the LDAP directory.
User filter
Search filter used to extract users from the LDAP directory. This filter must be formatted according to the standard LDAP syntax.
Group filter
Search filter used to extract groups from the LDAP directory. This filter must be formatted according to the standard LDAP syntax.
User attribute
The attribute of an LDAP user that defines this user’s identity.
Group attribute
The attribute of an LDAP group that defines this group’s identity.
Member attribute
The attribute of an LDAP group that defines which users are members of this group.
Full name attribute
The attribute of an LDAP user that defines this user’s full name.
Email attribute
The attribute of an LDAP user that defines this user’s email address.
Max page size
In LDAP directories, the size of transactions is limited to a maximum number of recordings at once (the size of the page). The value of this parameter must not exceed the maximum size permitted by the directory (1000 is the default value in LDAP directories). If the size is too small, this could affect performance. If the size is larger than the authorized limit, data will be missing in the user list.
For more information on the LDAP protocol, refer to .