OpenLDAP configuration and use cases - Identity as a Service

Connect your corporate OpenLDAP as an inbound identity provider for IDaaS to synchronize organizations and accounts, and enable users to log on to IDaaS or applications with their OpenLDAP credentials.

OpenLDAP basics

OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP), commonly used to manage enterprise resources such as users, computers, and networks. Due to its widespread use, OpenLDAP is often referred to simply as LDAP.

Note

With the network endpoint feature, you can synchronize LDAP data and perform delegated authentication without exposing a public port.

Connect to OpenLDAP

Step 1: Connect to OpenLDAP

Log on to the IDaaS console, select the target IDaaS instance, and click Console in the Actions column.
Click IdPs > Inbound > Add Inbound. Then, find OpenLDAP in the list and click Add.
On the Bind OpenLDAP panel, configure the following settings.
- Display Name: The name displayed to users when they log on to or use IDaaS.
- Network Access Endpoint: If you want to allow requests only from IDaaS, configure an IP address allowlist on your server. A shared endpoint uses a shared, fixed public outbound IP address. A dedicated endpoint uses a dedicated, custom private outbound IP address and public outbound IP address. A dedicated endpoint allows IDaaS to access your Alibaba Cloud VPC over a private network, allowing you to access your LDAP server without exposing a public port. For more information, see Network Endpoints.
- Server address: The address of your LDAP server. The default port for LDAP is 389, for example, 127.0.0.1:389. Port 636 is typically used when you enable LDAPS or StartTLS.
- Enable StartTLS: Enabling this option significantly improves connection security and is highly recommended. For instructions, see LDAP security configuration.
- Administrator Account: IDaaS uses this LDAP administrator account to read directory information for data synchronization and delegated authentication. This account must have at least read permissions and must be in Distinguished Name (DN) format, for example, cn=admin,ou=Technical Department,dc=example,dc=com.
- Administrator Password: The password for the administrator account.

Step 2: Select scenarios

Select the scenarios to enable for the LDAP integration.

Recommended configuration values for each field:

Basic Configuration

Synchronization Direction: User and organization data from the selected LDAP source is imported under this IDaaS node. For Source Node, enter the DN of the LDAP node. The root node DN is typically dc=example,dc=com (your domain).
Scheduled Full Sync: LDAP does not support incremental queries, so IDaaS performs a full sync of all data under the LDAP source node automatically early each morning.
- In field mapping, set a mapping identifier to match a field in an IDaaS account (such as mobile number) with a field in an LDAP user account (such as mobile number). If a match is found, the accounts are linked and the IDaaS account is updated. Otherwise, a new IDaaS account is created.
- To synchronize data immediately, manually trigger a full sync.
- IDaaS includes built-in sync protection. If more than 30 accounts or 10 organizations are scheduled for deletion, IDaaS automatically cancels the sync job to prevent accidental data loss. Adjust the sync protection settings based on the scale of your enterprise.
  
  In the Modify Sync Configuration dialog box on the Sync Rules tab, you can configure sync protection thresholds: if more than 30 accounts or more than 10 organizations are scheduled for deletion, the sync job is automatically canceled. In Advanced Settings, the default User ObjectClass is posixAccount,inetOrgPerson,top, and the default Organization ObjectClass is organizationalUnit,top.
- A failure to import data for a single account does not affect the import of other accounts.
- You can view failure information in the Sync Logs.
Delegated Authentication: Allows users to log on to IDaaS with their LDAP username and password.
Automatic Password Update: When a user logs on to IDaaS through delegated authentication, if the IDaaS account has no password, its password is set to the LDAP password. This update will fail if the LDAP password does not meet the IDaaS password policy.

Advanced Settings

User/Organization ObjectClass: Use ObjectClass to define what type of object is a user or an organization. For example, objects in query results where ObjectClass=user are treated as users.

Important
LDAP is highly customizable. If you have customized the ObjectClass for users or organizations, ensure the ObjectClass values match your LDAP schema to avoid unexpected data synchronization results in IDaaS.
User Logon Identity: When a user uses delegated authentication to log on to IDaaS, IDaaS searches LDAP based on these attributes to find the user and match the password. If the password is correct, IDaaS grants the user access. Separate multiple attributes with a comma to create an OR condition, allowing a user to log on with any of the specified attributes. Ensure that all specified attributes correspond to the same LDAP user, otherwise logon will fail.
User filter: To synchronize only a subset of users from different organizations to IDaaS, define a custom filter statement. Only users who match the conditions are synchronized. By default, the filter statement includes an AND condition for the ObjectClass. Click View Details to see the full statement. For more notes and common usage, see Filter syntax.

The complete filter statement example is (&(objectclass=posixAccount)(objectclass=inetOrgPerson)(objectclass=top)(cn=cn*)), where (cn=cn*) is the user-defined filter condition.

Step 3: Field mapping

Configure field mapping to link LDAP entries with existing IDaaS accounts and organizations. You can also populate IDaaS attributes with LDAP data, such as using an LDAP mobile number for the IDaaS account name. To use the mapping identifier feature, manually enable it for a field.

The field mapping page includes the following default mappings in the Account section:

Account Name (user.username) → Uid (can be set as identifier)
Display Name (user.displayName) → Common Name
Phone Region (user.phoneRegion) → Expression "86"
Phone (user.phoneNumber) → Telephone Number (enable Mapping Identifier)

The Organization section maps: Organization Name (organizationalUnit.organizationalUnitName) → Organizational Unit. You can Add or Remove mappings for each row. After configuration, click Save and Sync or Save Only.

Note

For more information about field mapping, see the Field Mapping documentation.

LDAP security configuration

By default, LDAP transmits data in plaintext, which risks data interception. LDAPS or StartTLS significantly improves transmission security. After you configure a certificate in your LDAP server, you can enable LDAPS or StartTLS in IDaaS. We strongly recommend enabling one of these options.

After configuring the certificate, retrieve the certificate fingerprint in IDaaS with a single click. This establishes a trust relationship between IDaaS and the LDAP certificate, preventing man-in-the-middle attacks via certificate spoofing.

In the Basic Configuration dialog box, configure the following:

Basic Information: Enter the Display Name.
Network Configuration: Set Network Access Endpoint to Shared Endpoint.
Server Configuration: Set the Server Address protocol to ldaps:// and the port to 636. Set Certificate Verification to Verify by Certificate Fingerprint and click Auto Retrieve to obtain the certificate fingerprint.
LDAP Domain Configuration: Enter the Administrator Account and Administrator Password, then click OK.

LDAP custom configuration

ObjectClass

In LDAP, an ObjectClass is a collection of attributes, and every object must have one. Use an ObjectClass to define an object as a user, organization, or computer. For example, if you set the User ObjectClass to inetOrgPerson,posixAccount,top, IDaaS treats the object as a user. You can view the ObjectClass when editing an object in LDAP.

Important

LDAP is highly customizable. If you have customized the ObjectClass for users or organizations, ensure the ObjectClass values match your LDAP schema to avoid unexpected data synchronization results in IDaaS.

Logon identity

When a user uses delegated authentication to log on to IDaaS, IDaaS searches LDAP using these attributes to find the user and match the password. If the password is correct, the user is allowed to log on to IDaaS.

Common logon attributes include uid, mobile phone number, email address, and employee ID. You can define these when creating the connection or in the Delegated Authentication settings. If you use multiple attributes, ensure they are unique and correspond to the same LDAP user. Otherwise, delegated authentication will fail.

Filter syntax

Important

Modifying the ObjectClass and filter affects the LDAP filtering conditions. During a full sync, IDaaS deletes accounts and organizations that no longer match the filter. Before making changes, we recommend that you adjust the sync protection threshold and fully test the filtering results to ensure they meet your expectations (for example, by using another IDaaS instance for testing).

Overview

To synchronize only a subset of users from different organizations to IDaaS, define a custom filter statement. Only users who match the filter are synchronized. By default, the filter statement includes an AND condition for the ObjectClass. Click View Details to see the full statement.

Test the filter statement in an LDAP administration tool to verify the results.

For example, on the Custom tab, enter (cn=xiaoyan) in the Filter input box and click Start. The search results display matching user DN records, such as uid=xiaoyan,ou=OrgName,dc=company,dc=cn.

The following are common syntaxes and statements for LDAP filters.

Common syntax

Operator	Description	Example
=	Equal to	(cn=Alice)
>=	Greater than or equal to	(pwdLastSet>=1319563845000000000)
<=	Less than or equal to	(employeeNumber<=1000)
&	AND (all conditions must be met)	(&(cn=CN*)(title=RD))
\|	OR (at least one condition must be met)	(\|(cn=Test)(cn=Admin))
!	NOT (the condition is not met)	(!(cn=Test)(cn=Admin))

Common statements

Scenario	Example
Username starts with "CN"	(cn=CN*)
User with a specific email address	(mail=alice@example.com)

LDAP synchronization configuration

Obtain the Base DN

A Base DN is the path identifier for a specific node in LDAP. IDaaS queries and synchronizes data only within this node's subtree. Set the Base DN of the source node in the Synchronization Direction settings.

The format of a DN is ou=Some Organization,dc=example,dc=com. The DN of the root node is typically dc=example,dc=com (your domain). You can also view the DN of a node directly in LDAP:

For example, in LDAP Admin, the top-level entry dc=company,dc=cn in the directory tree is the root node DN. You can expand it to view the organizational units (OUs) and user entries (CNs) beneath it.

Additionally, when the path of a node changes, its Base DN also changes. To prevent synchronization errors if a node is moved or renamed, IDaaS also uses the node's ObjectGuid as a node fingerprint when you configure the Base DN of a source node. If the Base DN changes and no longer matches the node fingerprint, data synchronization is blocked. Synchronization can resume after you reconfigure the source node.

Scheduled full sync

LDAP does not support incremental queries, so IDaaS performs a full sync of all data under the LDAP source node automatically early each morning. To synchronize data immediately, manually trigger a full sync.

IDaaS includes built-in sync protection. If more than 30 accounts or 10 organizations are scheduled for deletion, IDaaS automatically cancels the sync job to prevent accidental data loss. Adjust the sync protection settings to match your enterprise's scale.