LDAP and AD integration

Overview

LDAP (Lightweight Directory Access Protocol) is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an IP network. Directory services play an important role in developing intranet and Internet applications by allowing the sharing of information about users, systems, networks, services, and applications throughout the network. As examples, directory services may provide any organized set of records, often with a hierarchical structure, such as a corporate email directory. Similarly, a telephone directory is a list of subscribers with an address and a phone number.

AD (Active Directory) is a directory service that Microsoft developed for Windows domain networks. It is included in most Windows Server operating systems as a set of processes and services. Initially, Active Directory was only in charge of centralized domain management. Starting with Windows Server 2008, however, Active Directory became an umbrella title for a broad range of directory-based identity-related services.

WorkFusion Control Tower and WorkSpace can provide security (authentication and authorization) through LDAP and AD integration. Authentication is based on the Spring Security standard provider.

Control Tower configuration

By default, Control Tower provides local user, groups, and role management. LDAP and AD integration can be enabled by setting the following parameters in:

<TOMCAT_HOME>/conf/workfusion.properties:

## ldap properties
ldap.enabled=true
## to activate LDAP with WF roles switch this property to true. No groups from LDAP will be used.
#Properties ldap.group.base and ldap.group.filter will be ignored
ldap.internal.authorization.enabled=false

## container of corporate user database used for authentication
## support several base directories pipe separated <baseDN1>|<baseDN2>|...
ldap.user.base=ou=People,dc=somecompanydomain,dc=com

## container of corporate user groups used for authorization
## support several base directories pipe separated <baseDN1>|<baseDN2>|...
ldap.group.base=ou=Groups,dc=somecompanydomain,dc=com

## user filter for search, optional, alternative = (uid={0})
ldap.user.filter=(sAMAccountName={0})

## group filter for search, optional, alternative = (memberUid={1})
ldap.group.filter=(member={0})


## page size to load big amount of records to avoid size limit error
ldap.search.page.size=500
## group filter for list of all group names
ldap.search.all.groups.filter=(|(objectClass=group)(objectClass=groupOfNames)(objectClass=groupOfUniqueNames)(objectclass=posixGroup))
## ldap object attribute name that contains group name
ldap.search.groups.name.attribute=cn

Default configuration:

## ldap properties
ldap.enabled=false
ldap.internal.authorization.enabled=false
ldap.user.filter=(sAMAccountName={0})
ldap.group.filter=(member={0})
ldap.search.page.size=500
ldap.search.all.groups.filter=(|(objectClass=group)(objectClass=groupOfNames)(objectClass=groupOfUniqueNames)(objectclass=posixGroup))
ldap.search.groups.name.attribute=cn

See the following page to manager secure storage: Manage secure properties.

From version 9.2.0, new properties are added to avoid size limit error: ldap.search.page.size, ldap.search.all.groups.filter, ldap.search.groups.name.attribute

Secure properties:

## ldap server url
ldap.server.url=ldaps://{host}:{port}

## system user cridentials
ldap.bind.dn=<User distinguished name>
ldap.bind.password=<User password>

See the following page about managing Secrets Vault credentials: Manage secure properties.

External authorization

Before enabling LDAP at least one group should be mapped.

User groups are mapped in Control Tower during create or edit a User Group (default user roles you can find in Role Management):

After successful login, a user will be created or updated with data fetched from LDAP and AD.
The user properties cannot be changed in Control Tower. If LDAP configuration is enabled, only available filters can be added. The direct role selection is unavailable too.

If LDAP is enabled, a user cannot be created, deleted, or disabled in Control Tower. The Create, Delete and Disable buttons are unavailable. The System Preferences > User Settings: Account Details and Change Password sections are disabled too.

Internal authorization

To enable Internal Authorization, set the ldap.internal.authorization.enabled property to true.

Common assumptions: If LDAP authentication is passed successfully, a user is checked for existence in Control Tower, and Control Tower Roles are applied to the user, if such user exists. Otherwise, unable to login. User Properties cannot be changed in Control Tower if LDAP Internal configuration is enabled. You can only edit roles and enable or disable the user. A user can be created, deleted, or disabled in Control Tower. The Create, Delete and Disable buttons on the User Management page are available if LDAP with internal authorization is enabled. The System Preferences > User Settings: Account Details and Change Password sections are disabled too. The following properties are not used if LDAP with internal authorization is enabled: ldap.group.baseldap.group.filt.

How to

This is an example to give an overview of LDAP and AD integration.

At first, we should have distinqueshedName and password of the system user to initialize the connection properties. It can be any user with privileges to read the directory tree and the object attributes.

ldap.bind.dn=CN=System User,OU=demo,DC=somecompany,DC=local
ldap.bind.password=********

Configure the base directories for users and groups.

ldap.group.base=OU=Groups,OU=demo,DC=somecompany,DC=local
ldap.user.base=OU=Minsk,OU=Users,OU=demo,DC=somecompany,DC=local

It supports multi values with pipe separator for users and groups

Example for users

ldap.user.base=OU=Minsk,OU=Users,OU=demo,DC=somecompany,DC=local|OU=New York,OU=Users,OU=demo,DC=somecompany,DC=local

When the base directories are configured properly, it can help reducing time for searching users and/or groups.
ldap.group.base is a base directory for loading user's groups during login and a list of groups for External Group Name mapping on the Edit User Group page.

How to configure user filter

Usually, a username attribute for Microsoft Active Directory is sAMAccountName. In this case, ldap.user.filter=(sAMAccountName={0}).
For example, if we are going to use the email for login, so the filter looks as ldap.user.filter=(mail={0}).
Keep in mind that a user filter must return a unique result. Otherwise, it is configured incorrectly.

How to configure user group filter

ldap.group.filter=(member={0}). In this case, the {0} parameter is distinqueshedName of the logging in user.
For example, an alternative filter ldap.group.filter=(memberUid={1}). In this case, the {1} parameter is username of the logging in user.

How to configure filter to fetch all group names

This is via Control Tower only → Create or Edit User Group page → External Group Name.

ldap.search.all.groups.filter=(objectClass=groupOfNames)
ldap.search.groups.name.attribute=cn

WorkSpace configuration

By default, WorkSpace provides local user/role management. LDAP and AD integration can be enabled by setting the following parameters:

In <TOMCAT_HOME>/conf/workspace.properties (or workspace-sandbox.properties):

## ldap properties
ldap.enabled=true

## activate internal authorization if swithed to true with ldap.enabled
ldap.internal.authorization.enabled=false

## Comma separated group names from LDAP for mapping to worker users
ldap.worker.groups=CC Dev,Galiot,CC Ops

## Comma separated group of roles from LDAP which are mapped to the WorkSpace Requester role
ldap.requester.groups=CC Admin

## Name of license that is set to requester if new requester is created
ldap.requester.license=license_name

## container of corporate user database used for authentication
## support several base directories pipe separated <baseDN1>|<baseDN2>|...
ldap.user.base=ou=People,dc=crowdcomputingsystems,dc=com

## container of corporate user groups used for authorization
## support several base directories pipe separated <baseDN1>|<baseDN2>|...
ldap.group.base=ou=Groups,dc=crowdcomputingsystems,dc=com

## user filter for search, optional, alternative= (uid={0})
ldap.user.filter=(sAMAccountName={0})

## group filter for search, optional, alternative = (memberUid={1})
ldap.group.filter=(member={0})

## optional block
ldap.user.attribute.email=mail
ldap.user.attribute.firstName=givenname
ldap.user.attribute.lastName=sn
ldap.user.attribute.country=country

User group mapping is configured through ldap.worker.groups.

Default configuration:

## ldap properties
ldap.enabled=false
ldap.internal.authorization.enabled=false
ldap.user.filter=(sAMAccountName={0})
ldap.group.filter=(member={0})
ldap.user.attribute.email=mail
ldap.user.attribute.firstName=givenname
ldap.user.attribute.lastName=sn
ldap.user.attribute.country=country

Secure properties:

ws.secure.ldap.server.url=ldaps://{host}:{port}
## system user cridentials
ws.secure.ldap.bind.dn=<User distinguished name>
ws.secure.ldap.bind.password=<User password>

External authorization

After successful login, a user will be created or updated with data fetched from LDAP and AD.

The Register and Forgot password functionality is unavailable, if LDAP and AD is integrated.

Internal authorization

To enable internal authorization, set the ldap.internal.authorization.enabled property to true.

Common assumptions:

If LDAP authentication is passed successfully, a user is checked for existence in WorkSpace, and WorkSpace roles are applied to the user if such a user exists. Otherwise, unable to login.
User properties cannot be changed in WorkSpace if the LDAP internal configuration is enabled. You can only enable or disable the user.
Users can be created, deleted, and disabled in WorkSpace. The Create, Delete, and Disable buttons on the Workers and Requesters pages are available for requesters.
The following properties are not used if LDAP with internal authorization is enabled: ldap.group.baseldap.group.filter.

Troubleshooting

What to do if the customer wants the user without the "email" field in its settings on the LDAP side to be able to log in to CT?

The issue is related to the email field into the ApplicationUser MySQL table. The email column cannot be NULL. That is why if the LDAP user does not have the email field specified in its settings, he will not be able to log in to CT. As a workaround, the email column for the ApplicationUser table must be updated or changed.

Here is the MySQL query how to change the email column:

ALTER table ApplicationUser MODIFY column email
varchar(100) NULL; How ApplicationUser table looks like after
changing:No service restart is required.
.rwui_text_box.rwui_id_3d4e8597-66c9-4664-a1b3-f545289ed19e
{background-color: #EDF9ED; color:
#09B00E;}.rwui_text_box.rwui_id_3d4e8597-66c9-4664-a1b3-f545289ed19e
\*:not(.rwui_content) {color:
#09B00E;}.rwui_text_box.rwui_id_3d4e8597-66c9-4664-a1b3-f545289ed19e
span.rwui_icon {color: #09B00E;}

If a user failed to login and there are no messages in the log, except the following message: LdapSearchService [DEBUG] Searching for user '', with user search: base '', filter ''

Open the log4j file for a particular component:

Control Tower: install_dir/workfusion/conf/wf-log4j.properties
log4j.logger.org.springframework.security=TRACE
--------------------------------------------------------------
WorkSpace: Production -
install_dir/workspace_production/webapps/workspace/WEB-INF/log4j.properties,
Sandbox -
install_dir/workspace_sandbox/webapps/workspace-sandbox/WEB-INF/log4j.properties
log4j.logger.org.springframework.security=TRACE
------------------------------------------------------------- Then
restart workfusion/workspace/sandbox

Failed to log in and the following exception appears in the log: LDAP: error code 49 - 80090308: LdapErr: DSID-0C09042A, comment: AcceptSecurityContext error, data 568, v3839

There are too many groups (>1015) the user belongs to. Details are here.

Failed to log in due to an error during user group search

Log details:

LdapSearchService \[DEBUG\] Searching for groups with group search: base
'CN=Groups,DC=wftest,DC=int', filter '(\|(objectClass=group)(objectClass=groupOfNames)(objectClass=groupOfUniqueNames)(objectclass=posixGroup))'
2018-11-08 13:02:02 \[pool-8-thread-4\] LdapHealthChecker \[ERROR\]
Error loading the user groups from LDAP server. Please check the
ldap.server.url, ldap.bind.dn, ldap.bind.password secure connection
properties. Refer to "Manage Configuration Properties Guide".
com.google.common.util.concurrent.UncheckedExecutionException:
org.springframework.ldap.NameNotFoundException: \[LDAP: error code 32 -
0000208D: NameErr: DSID-03100241, problem 2001 (NO_OBJECT), data 0, best
match of: 'DC=wftest,DC=int'

The problem is the incorrect base directory for searching user groups.

WorkFusion Documentation

9.4

General services

APP

DB

OCR

VDS

OOTB configuration

Infrastructure scaling

Run preinstall manually

Using TLS certificates

Elastic Monitoring

Overview

Control Tower configuration

External authorization

Internal authorization

How to

How to configure user filter

How to configure user group filter

How to configure filter to fetch all group names

WorkSpace configuration

External authorization

Internal authorization

Troubleshooting