LDAP-directory/Active Directory (AD)

The LDAP/AD interface connects i-doit to your central directory. Users log in with their familiar credentials, and you can automatically synchronize persons and person groups.

Prerequisites#

i-doit supports the following directory services:

• OpenLDAP
• Microsoft Active Directory (AD)
• Novel eDirectory (formerly Directory Services)

The PHP extension php_ldap must be installed and enabled. If you have followed the installation instructions, the extension is already present on your system.

Required rights for the LDAP sync#

A user for the ldap-sync command requires the following minimum permissions:

1. Administration (command execute)

• Condition Commands and All rights for the parameter SyncCommand.

2. CMDB (edit objects & groups)

• Condition category in object type "Persons" and All rights for the category Persons - person group membership.

Subsequent installation on Debian GNU/Linux#

1
2

sudo apt install php-ldap
sudo service apache2 restart

Subsequent installation on Windows#

Edit the file php.ini (typically located at C:\xampp\php\php.ini). Enable the extension php_ldap by removing the semicolon at the beginning of the line.

From the line

1

;extension=php_ldap.dll

becomes

1

extension=php_ldap.dll

Depending on the version, it may be necessary to copy the files ssleay32.dll and libeay32.dll (usually located under C:\xampp\apache\bin\) into the php\ directory. Then restart the Apache web server.

Configuration#

The configuration is located in i-doit under Administration → Import and Interfaces → LDAP.

Server#

Under Administration → Import and Interfaces → LDAP → Server you configure one or more LDAP servers. During login, i-doit queries all configured servers one after another until a successful authentication occurs. With multiple tenants, all databases are offered where the query returns a positive result.

LDAP Connection for Lookups (read-only)#

Known solutions for TLS connection problems can be found at LDAP via TLS

LDAP parameters for i-doit login#

These parameters determine where i-doit searches for users in the directory.

You can further refine the filter. With a single filter line, the additional options have no effect yet. Only when you extend the query via Add filter do they take effect.

Append to last filter:

1

(&(objectClass=user)(test=test))

Append as new filter:

1

(&(objectClass=user)(&(test=test)))

Form new term:

1

(&(&(objectClass=user))(test=test))

In the lower section of the page you can test the configuration. On success, the following message appears:

1
2

Connection OK!
XX object(s) found in OU=tree,OU=synetics,DC=synetics,DC=int.

If the error message is not informative enough, increase the debug level. This causes i-doit to write more detailed output to the Apache error log. On Debian-based systems you can find it at /var/log/apache2/error.log.

Identifying objects#

Without additional settings (e.g. Unique identifier), i-doit identifies objects based on the Login attribute from the category Persons > Login.

Directories#

Under Administration → Import and Interfaces → LDAP → Directories you set up the attribute mapping. During login, i-doit queries basic information about the user and stores it in the person object. Select the applicable directory and adjust the assignment as needed. As a rule, the fields are already correctly pre-filled.

Import custom LDAP attributes#

You can also import custom LDAP attributes into the master data. Configure additional fields under Administration → Import and Interfaces → LDAP → Attribute extension. Once you have defined a name, the field appears in the master data and is populated during sync via the associated key.

Regular synchronization#

You have already completed the basic configuration in the previous steps. Now set up the appropriate i-doit console utility command to execute the synchronization on a regular basis. Optionally, configure additional fields to be synchronized.

Extended configuration#

An example can be found here. This file can be extended with login credentials, tenant, and additional options. For the ldap-sync command to consider it, specify it via the parameter -c /path/. Additional information can be found at the i-doit console utility.

Automatic assignment of persons to person groups#

The automatic assignment ensures that users receive the permissions of their person group automatically after login.

To set up the assignment:

1. Open the master data of a person group in i-doit.
2. Enter the name of the corresponding LDAP/AD group in the LDAP Group (Mapping) attribute.

During login or synchronization, i-doit compares the user's group memberships in the directory with the configured mappings. If they match, the person group is automatically assigned.

Synchronizing persons and person groups#

Since version 1.15, i-doit synchronizes persons and person groups from LDAP/AD. In this process, persons are automatically assigned to the groups they belong to in LDAP, provided those groups are captured by the configured filter.

A detailed guide can be found in the article Import users and groups from AD/LDAP.

The executing user requires supervisor permissions on the categories Group membership and Person groups > Members as well as on the object types Persons and Person groups.

Logging#

In the log/ directory of your i-doit installation you will find the log file ldap_YYYY-MM-DD.log. Logging is configured in the Admin Center or via the Expert settings.

Executing the ldap-sync#

The ldap-sync is executed via the command line of the server. First familiarize yourself with the i-doit console utility. For a simple synchronization without extended configuration, use the ldap-sync command.

Example usage from the i-doit directory

1

sudo -u www-data php console.php ldap-sync --user admin --password admin --tenantId 1 --verbose --ldapServerId 1