Integrating Webalo with LDAP or Active Directory

Transcription

1 Integrating Webalo with LDAP or Active Directory Webalo can be integrated with an external directory to identify valid Webalo users and then authenticate them to the Webalo appliance. Integration with LDAP and Active Directory are supported. 1) Configuring LDAP / Active Directory integration in Webalo. a) Gather information needed for configuring Webalo for use with the external directory. b) Go to the Webalo Appliance Administration Interface. Log in as the appliance admin. c) Click on External Directory Configuration in the left-hand pane and fill out the External Directory Configuration form:

2 d) The following data is needed for the Webalo External Directory Configuration form. You will need to select or edit the choices indicated below in red. The examples are for Active Directory and will depend on how LDAP or Active Directory is set up in your organization. i) External Directory Type: Select one of Active Directory, LDAP, None ii) Display in Agenda as: Specify a name for your external directory that will be displayed under People and Access in the Administrative Website, e.g., Active Directory 1 ). iii) Directory URL: Specify the URL for LDAP requests (e.g. LDAP://domain.yourcompany.com) iv) User Search Base Distinguished Name or DN: The Search Base should be set to a level that will include all potential Webalo users, e.g., CN=Users,DC=domain,DC=yourcompany,DC=com or OU=ActiveUsers,DC=domain,DC=yourcompany,DC=com v) Search Filter (optional): This filter specializes the query below the Search Base to specify how Webalo users are to be determined typically, by membership in a special Webalo group. E.g., (&(objectclass=user)(memberof=cn=webalouniversalgroup,cn=users,dc= domain,dc=yourcompany,dc=com)) or (&(objectclass=user)(memberof=cn=webalouniversalgroup,ou=security Groups,OU=Mobile,DC=domain,DC=yourcompany,DC=com) or, if searching subdirectories with OID: (&(objectclass=user)(memberof: :=cn= WebaloUniversalGroup,CN=Users,DC=domain,DC=yourcompany,DC=com)).

3 vi) Directory Authentication: (Anonymous, Basic) vii) Directory Admin DN: CN=WebaloProcessUser,CN=Users,DC=domain,DC=yourcompany,DC=com You will need to create this account ahead of time. A lightly permissioned Domain User is sufficient for the task: Create e.g., WebaloProcessUser, a standard User who is a member-of Domain Users. Select Extensions> Security> SELF, and change the permissions for WebaloProcessUser to: o Read - all read items listed should be checked. o Allowed to Authenticate - needs to be checked. o Change password - needs to be checked o All other items remain unchecked. viii) Directory Admin Password: Specify the password for the Directory Admin (e.g. WebaloProcessUser) referred to in the previous step ix) Full Name Attribute: Specify the AD field (e.g. name) to be used for the full name in Webalo. [Required] x) Attribute: Specify the AD field (e.g. mail) to be used for the in Webalo. [Required] xi) Login ID Attribute: Specify the AD field (e.g. userprincipalname recommended, but could be alternative Login ID Attribute such as samaccountname) to be used as the Login ID in Webalo. [Required] e) Select Save.

4 2. Synchronizing users in Webalo with Active Directory Webalo Group a. We recommend that the administrator make a snapshot of the Webalo virtual appliance prior to LDAP/AD synchronization, particularly if there are large numbers of users already in Webalo, or if LDAP/AD and Webalo naming conventions are different. b. Without logging out of the AAI as account admin, open a new browser and go to the Agenda at Log in as Webalo System Administrator. Select Manage Accounts. c. Select People and Access and there will be a new option available. The option is Synchronize with YourExtDir, where YourExtDir is the value you specified in the Display in Agenda field of the External Directory Configuration form. d. Select this Synchronize with YourExtDir option. e. The Review all Users in Account page will come up detailing all the users in your account and their groups. f. Press the Synchronize with Active Directory button and the synchronization process will start. When complete, you will see a list of deleted users, added users, and problem users. If the existing names in Webalo conformed to the name preservation specifications stated below, all existing users will be preserved from the existing Webalo configuration. g. If a Problem Encountered message comes up, either the Default Login ID Suffix was not configured in the system administration pages, or there was an error in the External Directory Configuration form. To correct the former, please review the document "Setting up Default Login ID Suffix for Active Directory and LDAP" listed in the documents section of support.webalo.com. Otherwise, please review your entries in the External Directory Configuration form to correct any errors.

5 3. Preserving Existing Login Names and Groups during Active Directory Integration Synchronization with LDAP/AD is able to preserve previously configured Webalo usernames and group assignments if the following conditions are true: 1) If the users are set up so that their login IDs agree with Active Directory, then the users, and their domain and group assignments, should be preserved. Note that IDs are case sensitive if the names are in capitals in AD, and in lower case in Webalo, the login ID s will not correspond. 2) When we say " login IDs agree..." we technically mean: a. That the full Webalo login IDs of the existing users are of the form: bjones%mydomain.com (note the "%") where "bjones" is what the user enters on his/her device (known as the User Logon Name in LDAP/AD terminology) and "mydomain.com" is what has been configured as the Webalo appliance-wide "Default Login ID Suffix" (set in the System admin web pages); b. AND that those login IDs, replacing the % by would be the same as the UPNs of the users in Active Directory.