LDAP and AD integration

Overview

LDAP - Lightweight Directory Access Protocol is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an IP network. Directory services play an important role in developing intranet and Internet applications by allowing the sharing of information about users, systems, networks, services, and applications throughout the network. As examples, directory services may provide any organized set of records, often with a hierarchical structure, such as a corporate email directory. Similarly, a telephone directory is a list of subscribers with an address and a phone number.

AD - Active Directory is a directory service that Microsoft developed for Windows domain networks. It is included in most Windows Server operating systems as a set of processes and services. Initially, Active Directory was only in charge of centralized domain management. Starting with Windows Server 2008, however, Active Directory became an umbrella title for a broad range of directory-based identity-related services.

WorkFusion Control Tower and WorkSpace can provide security (authentication and authorization) through LDAP / AD integration. Authentication is based on Spring Security standard provider.

Control Tower configuration

By default, Control Tower provides local user/groups/role management. LDAP / AD integration can be enabled by setting the following parameters in:

<TOMCAT_HOME>/conf/workfusion.properties:

## ldap properties
ldap.enabled=true
## to activate LDAP with WF roles switch this property to true. No groups from LDAP will be used.
#Properties ldap.group.base and ldap.group.filter will be ignored
ldap.internal.authorization.enabled=false

## container of corporate user database used for authentication
## support several base directories pipe separated <baseDN1>|<baseDN2>|...
ldap.user.base=ou=People,dc=somecompanydomain,dc=com

## container of corporate user groups used for authorization
## support several base directories pipe separated <baseDN1>|<baseDN2>|...
ldap.group.base=ou=Groups,dc=somecompanydomain,dc=com

## user filter for search, optional, alternative = (uid={0})
ldap.user.filter=(sAMAccountName={0})

## group filter for search, optional, alternative = (memberUid={1})
ldap.group.filter=(member={0})


## page size to load big amount of records to avoid size limit error
ldap.search.page.size=500
## group filter for list of all group names
ldap.search.all.groups.filter=(|(objectClass=group)(objectClass=groupOfNames)(objectClass=groupOfUniqueNames)(objectclass=posixGroup))
## ldap object attribute name that contains group name
ldap.search.groups.name.attribute=cn

Default configuration:

## ldap properties
ldap.enabled=false
ldap.internal.authorization.enabled=false
ldap.user.filter=(sAMAccountName={0})
ldap.group.filter=(member={0})
ldap.search.page.size=500
ldap.search.all.groups.filter=(|(objectClass=group)(objectClass=groupOfNames)(objectClass=groupOfUniqueNames)(objectclass=posixGroup))
ldap.search.groups.name.attribute=cn

New properties to avoid size limit error are as follows: ldap.search.page.size, ldap.search.all.groups.filter, ldap.search.groups.name.attribute

Secure properties:

## ldap server url
ldap.server.url=ldaps://{host}:{port}

## system user cridentials
ldap.bind.dn=<User distinguished name>
ldap.bind.password=<User password>

See the following page about managing Secrets Vault credentials : Manage Secure PropertiesFor version 8.2.1 the same properties are configured in the application.properties file

External authorization

Before enabling LDAP at least one group should be mapped.

User groups are mapped in Control Tower during create/edit a User Group.

After successful login a user will be created/updated with data fetched from LDAP / AD
The user properties cannot be changed in Control Tower, if LDAP configuration is enabled, only available filters can be added. The direct role selection is unavailable too.

If LDAP is enabled:a user cannot be create/deleted/disabled in Control Tower. The Create, Delete and Disable buttons are unavailable.System Preferences → User Settings: Account Details and Change Password sections are disabled too.

Internal authorization

Internal Authorization is available since version 8.4.4.To enable it, you should set property ldap.internal.authorization.enabled to true

Common assumptions:If LDAP authentication is passed successfully, a user is checked for existence in Control Tower, and Control Tower Roles are applied to the user, if such user exists. Otherwise, unable to login.User Properties cannot be changed in Control Tower, if LDAP Internal configuration is enabled. You can only edit roles and enable/disable the user.User can be created/deleted/disabled in Control Tower. The Create, Delete and Disable buttons on the User Management page are available, if LDAP with internal authorization is enabled. System Preferences → User Settings: Account Details and Change Password sections are disabled too.The following properties are not used, if LDAP with internal authorization is enabled:ldap.group.baseldap.group.filt

How To

This is an example to give an overview of LDAP / AD integration.

At first we should have distinqueshedName and password of the 'system user' to initialize the connection properties. It can be any user with privileges to read the directory tree and the object attributes.

ldap.bind.dn=CN=System User,OU=demo,DC=somecompany,DC=local
ldap.bind.password=********

Configure the base directories for users and groups.

ldap.group.base=OU=Groups,OU=demo,DC=somecompany,DC=local
ldap.user.base=OU=Minsk,OU=Users,OU=demo,DC=somecompany,DC=local

It supports multi values with pipe separator for users and groups

Example for users

ldap.user.base=OU=Minsk,OU=Users,OU=demo,DC=somecompany,DC=local|OU=New York,OU=Users,OU=demo,DC=somecompany,DC=local

When the base directories are configured properly, it can help reducing time for searching users and/or groups.
ldap.group.base is a base directory for loading user's groups during login and a list of groups for "External Group Name" mapping on the "Edit User Group" page.

Configure user filter

Usually, a username attribute for Microsoft Active Directory is sAMAccountName. In this case ldap.user.filter=(sAMAccountName={0})
For example, if we are going to use the email for login, so the filter looks as ldap.user.filter=(mail={0}). Keep in mind, that a user filter must return a unique result, otherwise it is configured incorrectly.

Configure user groups filter

ldap.group.filter=(member={0}). In this case {0} parameter is distinqueshedName of the logging in user
For example, an alternative filter ldap.group.filter=(memberUid={1}), In this case {1} parameter is username of the logging in user.

How to configure filter to fetch all group names (Control Tower only → Create/Edit User Group page → External Group Name filed)

ldap.search.all.groups.filter=(objectClass=groupOfNames)
ldap.search.groups.name.attribute=cn

WorkSpace configuration

By default, WorkSpace provides local user/role management. LDAP / AD integration can be enabled by setting the following parameters:

in <TOMCAT_HOME>/conf/workspace.properties (or workspace-sandbox.properties):

## ldap properties
ldap.enabled=true

## activate internal authorization if swithed to true with ldap.enabled
ldap.internal.authorization.enabled=false

## Comma separated group names from LDAP for mapping to worker users
ldap.worker.groups=CC Dev,Galiot,CC Ops

## Comma separated group of roles from LDAP which are mapped to the WorkSpace Requester role
ldap.requester.groups=CC Admin

## Name of license that is set to requester if new requester is created
ldap.requester.license=license_name

## container of corporate user database used for authentication
## support several base directories pipe separated <baseDN1>|<baseDN2>|...
ldap.user.base=ou=People,dc=crowdcomputingsystems,dc=com

## container of corporate user groups used for authorization
## support several base directories pipe separated <baseDN1>|<baseDN2>|...
ldap.group.base=ou=Groups,dc=crowdcomputingsystems,dc=com

## user filter for search, optional, alternative= (uid={0})
ldap.user.filter=(sAMAccountName={0})

## group filter for search, optional, alternative = (memberUid={1})
ldap.group.filter=(member={0})

## optional block
ldap.user.attribute.email=mail
ldap.user.attribute.firstName=givenname
ldap.user.attribute.lastName=sn
ldap.user.attribute.country=country

User group mapping is configured through ldap.worker.groups.

Default configuration:

## ldap properties
ldap.enabled=false
ldap.internal.authorization.enabled=false
ldap.user.filter=(sAMAccountName={0})
ldap.group.filter=(member={0})
ldap.user.attribute.email=mail
ldap.user.attribute.firstName=givenname
ldap.user.attribute.lastName=sn
ldap.user.attribute.country=country

Secure properties:

ws.secure.ldap.server.url=ldaps://{host}:{port}
## system user cridentials
ws.secure.ldap.bind.dn=<User distinguished name>
ws.secure.ldap.bind.password=<User password>

External authorization

After successful login a user will be created/updated with data fetched from LDAP / AD.

Register and Forgot password functionality is unavailable, if LDAP/AD is integrated.

Internal authorization

Internal Authorization is available since version 8.4.4.To enable it, you should set property ldap.internal.authorization.enabled to true

Common assumptions:If LDAP authentication is passed successfully, a user is checked for existence in WorkSpace, and WorkSpace Roles are applied to the user, if such user exists. Otherwise, unable to login.User Properties cannot be changed in WorkSpace, if LDAP Internal configuration is enabled. You can only enable/disable the user.User can be created/deleted/disabled in WorkSpace. The Create, Delete and Disable buttons on the Workers and Requesters pages are available for requesters. The following properties are not used, if LDAP with internal authorization is enabled:ldap.group.baseldap.group.filter

Troubleshooting

What to do if the customer wants the user without the "email" field in its settings on the LDAP side to be able to log in to CT?

The issue is related to the email field into the ApplicationUser MySQL table. The email column cannot be NULL. That is why if the LDAP user does not have the email field specified in its settings, he will not be able to log in to CT. As a workaround, the email column for the ApplicationUser table must be updated or changed.

Here is the MySQL query how to change the email column:

ALTER table ApplicationUser MODIFY column email
varchar(100) NULL; How ApplicationUser table looks like after
changing:No service restart is required.
.rwui_text_box.rwui_id_3d4e8597-66c9-4664-a1b3-f545289ed19e
{background-color: #EDF9ED; color:
#09B00E;}.rwui_text_box.rwui_id_3d4e8597-66c9-4664-a1b3-f545289ed19e
\*:not(.rwui_content) {color:
#09B00E;}.rwui_text_box.rwui_id_3d4e8597-66c9-4664-a1b3-f545289ed19e
span.rwui_icon {color: #09B00E;}

If a user failed to login and there are no messages in the log, except the following message: LdapSearchService [DEBUG] Searching for user '', with user search: base '', filter ''

Open the log4j file for a particular component:

Control Tower: install_dir/workfusion/conf/wf-log4j.properties
log4j.logger.org.springframework.security=TRACE
--------------------------------------------------------------
WorkSpace: Production -
install_dir/workspace_production/webapps/workspace/WEB-INF/log4j.properties,
Sandbox -
install_dir/workspace_sandbox/webapps/workspace-sandbox/WEB-INF/log4j.properties
log4j.logger.org.springframework.security=TRACE
------------------------------------------------------------- Then
restart workfusion/workspace/sandbox

Failed to log in and the following exception appears in the log: LDAP: error code 49 - 80090308: LdapErr: DSID-0C09042A, comment: AcceptSecurityContext error, data 568, v3839

There are too many groups (>1015) the user belongs to. Details are here.

Failed to log in due to an error during user group search

Log details:

LdapSearchService \[DEBUG\] Searching for groups with group search: base
'CN=Groups,DC=wftest,DC=int', filter '(\|(objectClass=group)(objectClass=groupOfNames)(objectClass=groupOfUniqueNames)(objectclass=posixGroup))'
2018-11-08 13:02:02 \[pool-8-thread-4\] LdapHealthChecker \[ERROR\]
Error loading the user groups from LDAP server. Please check the
ldap.server.url, ldap.bind.dn, ldap.bind.password secure connection
properties. Refer to "Manage Configuration Properties Guide".
com.google.common.util.concurrent.UncheckedExecutionException:
org.springframework.ldap.NameNotFoundException: \[LDAP: error code 32 -
0000208D: NameErr: DSID-03100241, problem 2001 (NO_OBJECT), data 0, best
match of: 'DC=wftest,DC=int'

The problem is the incorrect base directory for searching user groups.

WorkFusion Documentation

9.2

General services

APP

DB

OCR

VDS

OOTB configuration

Infrastructure scaling

Run preinstall manually

Using TLS certificates

Elastic Monitoring

Overview

Control Tower configuration

External authorization

Internal authorization

How To

Configure user filter

Configure user groups filter

WorkSpace configuration

External authorization

Internal authorization

Troubleshooting