Configuring LDAP Settings

about ldap settings active directory is the only directory service tested for ldap operation with you can configure and synchronize employee profiles from your ldap active directory server to the employee business object the data import wizard imports users from selected nodes in the directory server and supports attribute mapping it also maps profiles to linked business objects such as managers and organizational units you can run the wizard manually or schedule synchronizations the ldap server stores user passwords and retrieves them directly, and not from before setting up ldap if you see the error message internal ip is not accessible during ldap import for test connection, the server ip address may fall within a restricted range for security reasons this check prevents unauthorized access to ivanti servers from untrusted networks set the global constant enableinternalipforldap to true then try the import again we recommend using https or imaps to connect if you connect through a vpn, contact your ivanti software service representative before setting up any ldap synchronization actions, first set up an ldap/ldaps authentication provider see working with adfs/saml docid\ m7 6vn8mfoe0h9e8bu a3 requirements ensure that the data center can connect to your ldap server use a standard ldap browser tool outside your network to confirm that ldap/ldaps works with the standard ports (389 for ldap, 636 for ldaps) open the appropriate ports (389 for ldap or port 636 for ldaps) configure certificates in your ldap server request an ip address from ivanti if you need to open ldap only for firewall configuration have ldap login credentials ready to test import and authentication contact support if you encounter connection issues synchronizing ldap settings synchronization occurs only from the ldap server to , not from to ldap the process runs only when changes are made to the ldap source, such as active directory ldap port for ldap active directory, use port 389 for ldap or port 636 for ldaps the protocol is tcp about the ldap content synchronization protocol uses the ldap content synchronization protocol (csp), as described in rfc 4533 (https //tools ietf org/html/rfc4533) https //tools ietf org/html/rfc4533 to implement incremental synchronization of ldap server entries configure the ldap server to support csp if csp requires an optional component or plugin, install it ensure the identity used to access the ldap server has the required permissions for the directory sub tree being synchronized the required components and permissions depend on the ldap server type the ldap csp supports replication of any directory sub tree for which the synchronization user has permission active directory supports replication of root level directory trees only because of this limitation, ivanti itsm also supports the older synchronization method based on version stamps in each record select enable incremental updates to use this method use csp for synchronizing entire directory roots use the older method if you need to synchronize a sub tree or if your server does not support csp openldap supports replication of both root level directories and sub trees other ldap implementations may or may not support csp and may restrict which directory levels can be synchronized the older synchronization method is specific to active directory and cannot be used with other ldap servers connecting to directory you can test your server connection with selected credentials from the configuration console, click extend > integration tools > ldap settings to open the ldap settings workspace click add new the ldap wizard appears ldap settings connect to directory page enter information into the fields field description setting name a unique name for this ldap server connection server a valid ldap server name or ip address (for example, 10 34 25 21) to connect to a specific port, append the port number with a semicolon servername\ portnumber base dn the distinguished name for the ldap object in the ldap server value is not case sensitive user enter a user name if the server requires authentication password enter a password if the server supports anonymous authentication connection timeout specify the timeout period (in seconds) the application attempts to connect until the timeout expires if unsuccessful, an exception message appears create records of type select the type of records to create (employee or external contact) connect to edirectory open ldap server connects to edirectory and the open ldap server use ntlm authentication if you selected connect to edirectory/open ldap server , you must also select this option open ldap requires ntlm authentication enable incremental updates \[optional] enables incremental updates through active directory if not using connect to edirectory/open ldap server enable synchronous replication \[optional] enables synchronous replication for more information, see http //www openldap org/doc/admin22/syncrepl html http //www openldap org/doc/admin22/syncrepl html ssl connection provides a secure socket layer connection, if you are using ldaps click test connection to verify your connection the connection test results (successful or unsuccessful) message appears click next selecting the directory information to synchronize enter user locations or organizational units to synchronize if you change a user’s email address after the initial synchronization, subsequent synchronization attempts will fail ldap settings select directory info to sync enter information field description preset defines the ldap object filter select a default search filter from the dropdown the default is users filter \[optional] enter a valid filter string and click save new preset the application adds the value to the preset list click remove preset to delete the current value root ldap node(s) perform one of the following to restrict ldap searches, enter one or more valid root nodes use the ldap directory browser to locate a directory, then click add selected node as root sample ldap entry to extract fields from do one of the following each ldap entry belongs to an ldap class and contains a set of fields use this option to add a sample ldap entry containing fields to be retrieved in a fetch operation use the ldap directory browser to locate a sample entry, then click select sample entry the entry shows the ldap entry syntax, such as cn=class name, ou=organizational unit, dc=domaincomponent1 (derived from company dns domain components), dc=domaincomponent segment2 for example cn=barnard jeffries,ou=users,ou=pleasanton,dc=companyx,dc=com click refresh to update the window click next the application tests the selected options about field mapping the record settings workspace enables field mapping, relationship mapping, role access, and advanced settings the application displays fields based on the selections made in the previous step ldap field mapping page about expression functionality you can use expressions to transform values or apply complex logic during field mapping examples of field mapping using expressions directory emails end in @domain com it must be transformed in to end with @tenant com the mapping expression is primaryemail = $(if(find('@domain com', mail) > 1 then samaccountname + '@tenant com' else mail)) map the department field based on the distinguished name component if you call the dn () built in function without parameters, the whole distinguished name is returned for cn=john doe, ou=developers, ou=personnel, dc=company ldap entry, the mapping expression is department = $(if(dn(1) == 'developers' then 'research & development' else 'it') expressions for field mapping to enable expressions for field mapping, select \[use expression] in the ldap field name control ldap field name control this invokes the expression editor see about expressions docid 0eih f97oc4pmanhy9f29 edit your expression using ldap entry fields and other functions from the properties and functions tree if an ldap field name already contains an expression, the expression editor automatically appears selecting \[use text value] from the properties tree removes expression from the mapping the expression is also disabled if $( symbols are not used in the beginning of the expression text expressions for relationship mapping this expression functionality is also enabled for relationship mapping ldap synchronization can create an organizational unit if the required organizational unit does not exist all new organizational units are created with a parent organizational unit selected in the parent organizational unit name control ldap parent organizational unit name organizational unit the parent organizational unit name control is a tree list selector where you can select organizational units in a user friendly form parent organizational unit name control examples of mapping expressions the mapping expression $(if(dn(1) == 'developers' then 'research & development' else 'it')) says that two organizational units are required for the import research & development, and it these organizational units are created (if they did not exist before the import) and placed under the organizational unit in the tree which is selected as parent if the organizational unit already exists, it is used for import the application uses the default organizational unit by default mapping fields click the contact field name field and choose the field to use as the primary contact field the default is primaryemail under contact field mapping , from the preset dropdown, choose a mapping file the default list is active directory when selected, the tables on this page are populated with default values you can retain the defaults or add custom values ivanti has tested only active directory as its ldap directory service you must map the loginid field to the ldap user id, or ldap external authorization will not perform correctly enter information into the field mapping table you can use an expression for the ldap field name fields represent field names in directory fields are the field names in active directory you can enter the attribute directly in the directory field if you enter a new attribute in the directory field, you must select use default for the corresponding value field creating new records using the ldap import process works only for simple validation lists; for example, pick lists that are not constrained (such as department) field mapping expressions using comparison with if are case sensitive for example, use the following expression for organizational unit $(if((dn(2) == 'california') then 'california' else 'colorado')) if you used "california" (lower case "c"), then the return data is colorado to receive the correct data, in this case, use "california " to map the manager field, you can use the parsedn () built in function (see parsedn docid 56dcyhtq3zsaw0sogu2tx ) example using the parsedn() built in function click the add icon to add a new entry (a table row) if you select \[use text value], the value field becomes active the text entered in this field is saved in the profile if you select an ldap field, the use default field becomes available by default, this value is unchecked during import, if the ldap field is not found, the value field is used if you select an ldap field, which is not in the menu, then you can enter that field name and click check default under contact relationships , choose the parent organizational unit name, or choose default select fields from the ldap compliant directory which will be used to create relationships in your solution for each contact record this relationship must match exactly for example, if you attempt to use the manager field in active directory, the import will fail because this field includes an ldap distinguished name instead of a simple user name or email address click the add icon to add a new entry (a table row) under contact roles , add roles that can be imported using this connection the default role is self service click self service to show the role list, then check the roles to include ldap ivanti contact roles to retain the existing roles, check keep existing roles if checked, the import process keeps all assigned roles for existing contacts and then creates roles defined in the current record settings if unchecked, the existing roles are deleted and the selected roles are added by default, contacts that already exist before the import process runs keep their current roles and add the roles you have defined as part of the current record settings under advanced settings , select any of the following option description allow ivanti to access ldap directory when certificate is non trusted connects through ssl to the ldap compliant server even if the certificate is not trusted override employee login overrides the employee login settings add ldap login and server to imported accounts adds ldap settings into the user profile record disable ivanti users who have been disabled in the ldap compliant directory using the value of the fields disables existing contacts during the import process if they are disabled in ldap enter the field values to check for disabled users disable ivanti users who have been expired in the ldap compliant directory disables existing contacts during the import process if they are expired in ldap import groups by default, the system imports only users select this checkbox to also import groups when selected, the synchronization includes all groups available in the chosen sample entry click preview to see your data from the profile dropdown, choose defined ldap entries to be used during synchronization according to the root ldap nodes and filter parameters select a defined ldap entry from the displayed list ldap entry field values are shown according to fields mapping settings close the window when finished click next excluding items input any specific users that you do not want to synchronize put each dn regular expression on a separate line enter a list of regular expression patterns used to exclude ldap entries from being imported during the synchronization for example, the pattern ou=development excludes all entries with a dn containing the ou=development substring add the patterns to the exclude items field, with each value listed on a separate line click next completing the synchronization click synchronize now to start synchronization the application imports the data and records the information in the ldap import log click save the data is stored in table format on the main ldap synchronization page click sync now to run the synchronization again you can create a scheduled ldap synchronization workflow in the workflow editor using the ldap sync workflow block see ldap sync workflow block docid\ o6bfjneaic31xiraqjz1z for more information check save plain ldap password to database to save the ldap password to the database for internal authorization use within this action takes place during the synchronization process