OpenLDAP configuration and use cases - Identity as a Service

Connect your corporate OpenLDAP as an inbound identity provider for IDaaS to synchronize organizations and accounts, and enable users to log on to IDaaS or applications with their OpenLDAP credentials.

OpenLDAP basics

OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP), commonly used to manage enterprise resources such as users, computers, and networks. Because it is so widely used, OpenLDAP is often referred to simply as LDAP.

Note

With the Network access endpoints feature, you can synchronize LDAP data and perform delegated authentication without exposing a public port.

Connect to OpenLDAP

Step 1: Connect to OpenLDAP

Log on to the IDaaS console, select the target IDaaS instance, and click Console in the Actions column.
Click IdPs > Inbound > Add Inbound. Then, find OpenLDAP in the list and click Add.
On the Bind OpenLDAP panel, configure the following settings.
- Display Name: The name that users may see when they log on to or use IDaaS.
- Network Access Endpoint: If you want only IDaaS to be able to send requests to this LDAP server, configure an IP address allowlist on the server. A shared endpoint uses a shared, fixed public outbound IP address. A dedicated endpoint uses dedicated, custom private outbound and public outbound IP addresses. Through a dedicated endpoint, IDaaS can access your Alibaba Cloud Virtual Private Cloud (VPC) over a private network, so it can reach your LDAP server without exposing a public port. For more information, see Network access endpoints.
- Server address: The address of the server where LDAP is deployed. LDAP uses port 389 by default, for example, 127.0.0.1:389. Port 636 is typically used when LDAPS or StartTLS is enabled.
- Enable StartTLS: Enabling this option significantly improves connection security. As a best practice, turn it on. For instructions, see LDAP security configuration.
- Administrator Account: IDaaS uses this LDAP administrator account to read LDAP information for data synchronization or delegated authentication. The account must have at least read permissions and must be in DN format (cn=admin,ou=Technical Department,dc=example,dc=com).
- Administrator Password: The logon password of this account.

Step 2: Select scenarios

In Step 2, select the scenarios that you want to implement with LDAP.

The recommended configuration values of the fields in this example are as follows:

Scheduled Full Sync: Enabled; Delegated Authentication: Enabled; Automatic Password Update: Disabled
User ObjectClass: posixAccount,inetOrgPerson,top
Organization ObjectClass: organizationalUnit,top
User Logon Identity: uid,cn,mail
User filter: Leave empty (you can specify it as needed, for example, (cn=China*))

Basic Configuration

Synchronization Direction: The user and organization data of the selected LDAP synchronization source is imported under this IDaaS node. For Source Node, enter the DN of the LDAP node. The DN of the LDAP root node is generally dc=example,dc=com (that is, your domain).
Scheduled Full Sync: Because LDAP does not support incremental queries, IDaaS automatically performs a full synchronization of all data under the LDAP source node early every morning.
- You can set a mapping identifier in field mapping to match a field of an IDaaS account (such as the mobile phone number) with a field of an LDAP user (such as the mobile phone number). If a match is found, the accounts are bound and the IDaaS account is overwritten with the update; otherwise, an IDaaS account is created.
- To synchronize data immediately, manually trigger a full synchronization.
- IDaaS has a built-in synchronization protection capability. When more than 30 accounts or more than 10 organizations need to be deleted, the synchronization task is automatically canceled to prevent data from being deleted by mistake. Adjust the synchronization protection settings based on the size of your enterprise.
  In the Modify Sync Configuration dialog box, on the Sync Rules tab, you can configure the synchronization protection thresholds: when more than 30 account records or more than 10 organization records need to be deleted, the system automatically cancels the synchronization task. In Advanced Settings, the default User ObjectClass is posixAccount,inetOrgPerson,top, and the default Organization ObjectClass is organizationalUnit,top.
- If a single account record fails to be imported, the import of other data is not affected.
- You can view failure information in Sync Logs.
Delegated Authentication: Users can log on to IDaaS with their LDAP username and password.
Automatic Password Update: When a user logs on to IDaaS through LDAP delegated authentication, if the password of the IDaaS account is empty, it is updated to the password of the LDAP account. The LDAP password must meet the requirements of the IDaaS password policy; otherwise, the password cannot be automatically updated.

Advanced Settings

User/Organization ObjectClass: You can use ObjectClass to define which type of object is a user or an organization. For example, objects with ObjectClass=user in the query results are treated as users.
Important
LDAP is highly customizable. If you have customized the ObjectClass of users or organizations, make sure that the ObjectClass values are consistent, so that the data synchronized to IDaaS meets your expectations.
User Logon Identity: When a user logs on to IDaaS by using LDAP delegated authentication, IDaaS searches LDAP for the user based on these attributes and matches the password. If the password is correct, the user is allowed to log on to IDaaS. You can separate multiple attributes with commas (,), which creates an OR relationship, meaning that a user can log on with any one of the attributes. Make sure that the multiple attributes correspond to the same LDAP user; otherwise, the user cannot log on.
User filter: If you need to synchronize only some users that are scattered across different organizations to IDaaS, you can customize the filter statement. Only users that meet the conditions can be synchronized to IDaaS. By default, the filter statement includes an AND condition for the ObjectClass. You can click View Details to view the complete statement. For more considerations and common usage, see Filter.
A complete example of the filter statement is (&(objectclass=posixAccount)(objectclass=inetOrgPerson)(objectclass=top)(cn=cn*)), where (cn=cn*) is the filter condition that the user adds.

Step 3: Field mapping

If IDaaS already contains existing data, you may need to bind LDAP users and organizations to IDaaS accounts and organizations. You may also want to use certain field values of LDAP users as IDaaS account data, for example, using the mobile phone number of an LDAP user as the account name of the IDaaS account. In these cases, configure field mapping in Step 3. To use the mapping identifier capability, manually click to enable it, for example, for the mobile phone number field.

On the field mapping page, the default mappings in the Account section are as follows:

Account Name(user.username) → Uid (can be set as the identifier)
Display name(user.displayName) → Common Name
Phone Region(user.phoneRegion) → the expression "86"
Phone(user.phoneNumber) → Telephone Number (enable Mapping Identifier)

Organization section mapping: Organization Name(organizationalUnit.organizationalUnitName) → Organizational Unit. For each row, you can click Add or Remove to adjust the mapping. After you complete the configuration, click Save and Sync or Save Only.

Note

For more information about field mapping, see Field mapping.

LDAP security configuration

By default, LDAP does not encrypt or protect data during transmission, which poses a risk of plaintext data being stolen. LDAPS or StartTLS effectively improves the security of data transmission. After you configure a certificate in LDAP, you can use LDAPS or StartTLS in IDaaS. We strongly recommend that you enable one of them.

After you configure the certificate, you can get the certificate fingerprint with one click in IDaaS to establish a trust relationship between IDaaS and the LDAP certificate, which reduces the risk of certificate forgery.

In the Basic Configuration dialog box, complete the following configuration:

Basic Information: Enter the Display Name.
Network Configuration: Set Network Access Endpoint to Shared Endpoint.
Server Configuration: Set the Server address protocol to ldaps:// and the port to 636. Set Certificate Verification to Verify by Certificate Fingerprint, and then click Auto Retrieve to get the certificate fingerprint.
LDAP Domain Configuration: Enter the Administrator Account and Administrator Password, and then click OK.

LDAP custom configuration

ObjectClass

In LDAP, an ObjectClass is a collection of attributes, and every object must have an ObjectClass. You can use an ObjectClass to define an object as a user, an organization, or a computer. For example, for a specific object, when you set the UserObjectClass to "inetOrgPerson,posixAccount,top" in IDaaS, IDaaS treats the object as a user. When you edit an object in LDAP, you can see the ObjectClass.

Important

LDAP is highly customizable. If you have customized the ObjectClass of users or organizations, make sure that the ObjectClass values are consistent, so that the data synchronized to IDaaS meets your expectations.

Logon identity

When a user logs on to IDaaS by using LDAP delegated authentication, IDaaS searches LDAP for the user based on these attributes and matches the password. If the password is correct, the user is allowed to log on to IDaaS.

Generally, you can use attributes such as uid, the mobile phone number, the email address, and the employee ID for logon. If needed, you can define them when you create the connection or in Delegated Authentication. If you use multiple attributes, make sure that the attributes are unique and correspond to the same LDAP user; otherwise, users cannot use delegated authentication.

Filter

Important

Modifying the ObjectClass and the filter affects the LDAP filtering conditions. During a full synchronization, IDaaS accounts and organizations that no longer meet the filtering conditions are deleted. Adjust the synchronization protection quota before you make changes, and fully test whether the filtering results meet expectations (for example, by using another IDaaS instance for testing).

Overview

If you need to synchronize only some users that are scattered across different organizations to IDaaS, you can customize the filter statement. Only users that meet the conditions can be synchronized to IDaaS. By default, the filter statement includes an AND condition for the ObjectClass. You can click View Details to view the complete statement.

The complete filter statement is (&(objectclass=posixAccount)(objectclass=inetOrgPerson)(objectclass=top)(cn=cn*)), where (cn=cn*) is the custom filter condition that is added.

You can enter the filter statement in the LDAP Admin tool to check the filtered results.

For example, on the Custom tab, in the Filter box, enter (cn=xiaoyan), and then click Start. The search results display the matching user DN records, such as uid=xiaoyan,ou=Organization Name,dc=company,dc=cn.

The following are the common syntax and statements of LDAP filters.

Common syntax

Operator	Description	Example
=	Equal to	(cn=Alice)
>=	Greater than or equal to	(pwdLastSet>=1319563845000000000)
<=	Less than or equal to	(employeeNumber<=1000)
&	AND. All conditions must be met.	(&(cn=CN*)(title=RD))
\|	OR. At least one condition must be met.	(\|(cn=Test)(cn=Admin))
!	NOT. The conditions must not be met.	(!(cn=Test)(cn=Admin))

Common statements

Scenario	Example
The username starts with "CN"	(cn=CN*)
The user with a specified email address	(mail=alice@example.com)

LDAP synchronization configuration

Obtain the Base DN

A Base DN is the path identifier of a node in LDAP. IDaaS performs operations such as queries and data synchronization only under this node. You can set the Base DN of the source node in Synchronization Direction.

The format of a DN is ou=Some Organization,dc=example,dc=com. The DN of the root node is generally dc=example,dc=com (that is, your domain). You can also view the DN of a node directly in LDAP.

For example, in the LDAP Admin tool, dc=company,dc=cn at the top level of the directory tree is the DN of the root node. You can expand it to view the organizational units (OUs) and user entries (CNs) under it.

In addition, when the path of a node changes, the Base DN of the node also changes. To avoid LDAP data synchronization errors caused by node path adjustments, when you configure the Base DN of the synchronization source node in IDaaS, IDaaS also uses the ObjectGuid of the node as the node fingerprint. When the Base DN of the node changes and no longer matches the node fingerprint, data synchronization is blocked. Synchronization resumes after you reconfigure the source node.

Scheduled full sync

Because LDAP does not support incremental queries, IDaaS automatically performs a full synchronization of all data under the LDAP source node early every morning. To synchronize data immediately, manually trigger a full synchronization.

IDaaS has a built-in synchronization protection capability. When more than 30 accounts or more than 10 organizations need to be deleted, the synchronization task is automatically canceled to prevent data from being deleted by mistake. Adjust the synchronization protection settings based on the size of your enterprise.