Versions Compared

Old Version 2

changes.mady.by.user Karl Henselin

Saved on

compared with

New Version 3

changes.mady.by.user Karl Henselin

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Field

Required

Description

Realm Name

Yes

Description

No

URL

Yes

URL to access LDAP server

For example, ldap://localhost:10389

System Username

Yes

Read-only username to access LDAP server. This should be fully qualified username in LDAP. FlexDeploy will use the system username and system password to bind to LDAP for various operations.

For example, uid=admin,ou=system

System Password

Yes

Password for specified system user name.

User Search Base

Yes

User base tree in LDAP server

For example, ou=users,ou=system.

User Search Filter

Yes

User search filter to find user records in user search base

For example, (&(objectClass=*)(uid={0})), (&(objectClass=*)(sAMAccountName={0}))

Tip

To restrict users able to login to FlexDeploy by membership within a particular LDAP group, you can use a search filter similar to the following. This assumes that your LDAP supports the memberOf virtual attribute.

(objectClass=user)(sAMAccountName={0})(memberOf=CN=FDDevelopers,CN=Users,DC=flexagondev,DC=local)

Similarly, more than one group would look like this.

(&(objectClass=user)(sAMAccountName={0})(|(memberOf=CN=FDDevelopers,CN=Users,DC=flexagondev,DC=local)(memberOf=CN=FDAdmins,CN=Users,DC=flexagondev,DC=local))

Connect Timeout

No

A timeout, in seconds, for connecting to the external server. The default timeout is 30 seconds. If no value is provided, there is no timeout.

Read Timeout

No

A timeout, in seconds, for LDAP read operations. The default timeout is 120 seconds. If no value is provided, there is no timeout.

Follow Referrals

Yes

How to handle referrals (follow/ignore). The default is ignore.

Group Mapping Enabled

Yes

Enable if you want to map LDAP groups to FlexDeploy groups. LDAP server must support memberOf attribute for group mapping in FlexDeploy.

Group Search Base

No*

Group base tree in LDAP server. Required if group mapping is enabled.

For example, (ou=groups,ou=myrealm,dc=MyDomain)

Group Search Filter

No*

Search filter to find groups in group search base. Required if group mapping is enabled.

For example, (objectClass=groupOfUniqueNames)

Using ldaps

A FlexDeploy realm can be configured to use ldaps protocol, which requires adding a server certificate to Java cacerts or the application server trust store.

You may encounter java.security.cert.CertificateException: No subject alternative names present when using SSL connection and the hostname in connection URL is not valid when compared to the SSL certificate of the server. This error occurs in java 1.8.0_181 or higher is because this update includes security improvements for LDAP support. Endpoint identification has been enabled on LDAPS connections. In this situation, you must regenerate the LDAP server certificate with the certificate’s SAN or CN matching the hostname of the LDAP server configured in connection URL. This is not recommended for production installation, but you can temporarily disable this by adding -Dcom.sun.jndi.ldap.object.disableEndpointIdentification=true to server startup arguments.