Drive and Photo Service:Configure AD/LDAP login

Step 1: Configure LDAP login

1. Go to the Domains page of Drive and Photo Service (Developer Edition).

2. In the top-left corner, select the region where your domain is located.

   

3. Find the domain you want to configure for LDAP Logon, and click Details in the Actions column.

   

4. On the domain details page, select the User Systems tab and click Configure to open the Configure PDS Logon Page panel.

5. Turn on the Enable Logon by LDAP switch and configure the following parameters.

   Parameter	Example	Description
   Hostname	ldap://120.XX.XX.XX	The address of the LDAP server. The address must start with ldap://. Supported formats are: IP address: Idap://120.XX.XX.XX Domain name: ldap://www.example.com
   Port	389	The default port is 389. If your server uses a different port, enter the new port number.
   UID	sAMAccountName	This field specifies the username for login. The value must match the corresponding field in the LDAP Attribute Editor.
   Administrator DN	CN=admin,DC=chwl,DC=com	The distinguished name (DN) of an administrator account. This account must have permission to read all organizational units and users under the specified BaseDN. For instructions on how to obtain the administrator DN in a Windows AD environment, see Appendix 2: Obtaining the Administrator DN.
   Administrator Password	*****	The password for the administrator account. Drive and Photo Service (Developer Edition) uses this account to connect to your LDAP server to read user information for synchronization and authentication.
   BaseDN	DC=chwl,DC=com	The root of the LDAP directory tree where the search for users and groups begins. Only organizational units and users within this scope are synchronized. For instructions on how to obtain the BaseDN in a Windows AD environment, see Appendix 1: Obtaining the BaseDN. Important Configure this parameter with caution. Do not change the BaseDN after the initial synchronization. If you modify the BaseDN, Drive and Photo Service (Developer Edition) cannot match the directory structure with the LDAP or AD server, causing synchronization to fail.

6. Click OK to save the settings.

Step 2: Sign in by using LDAP

1. You can use the desktop client or a browser to access the URL https://domainID.apps.aliyunpds.com.

   Important

   When a browser is used, replace domainID with the actual value.

2. On the logon page, click AD/LDAP.

   

3. Enter your LDAP username and password to sign in.

Step 3: Configure LDAP account synchronization

1. Sign in to Drive and Photo Service (Developer Edition) with an administrator account and go to the Management Console.

2. In the navigation pane on the left, choose Exclusive Login Configuration > LDAP Configuration.

   

3. In the Synchronization Configuration section, click Edit.

4. Configure the Login Configuration settings.

   1. On the LDAP Configuration page, configure the Login Configuration settings.

      

      The following table describes the parameters.

      Parameter	Example	Description
      Login Username Field	sAMAccountName	This field serves as the account name for user login. It must be consistent with the field in the LDAP Attribute Editor.
      Display Name Field	displayName	This field serves as the display name in the user's network drive. It must be consistent with the field in the LDAP Attribute Editor.

   2. Click Next.

5. Configure the Synchronization Configuration settings.

   • You can skip this step if you do not need to synchronize users and groups from LDAP. If you only enable LDAP login without configuring synchronization, any user in your LDAP directory can sign in. An account is created automatically upon first login, but the user will not belong to any team.

   • If you enable synchronization, you can import users and organizational structures from your LDAP directory. Follow these steps:

     1. On the Synchronization Configuration page, turn on the Synchronization Configuration switch and configure the synchronization information.

        

        The following table describes the parameters.

        Note

        • To synchronize both LDAP organizations and users, you must configure settings for both teams and users.

        • To synchronize only LDAP organizations, configure only the settings for teams.

        • To synchronize only LDAP users, configure only the settings for users.

        Parameter	Example	Description
        Team Object Classes	organizationalUnit	An organizational unit (OU) is an AD container for users, groups, computers, and other OUs. It is the smallest scope for assigning group policy settings or delegating administrative permissions. The group object class is not supported.
        User Object Classes	User	You can enter organizationalPerson, inetOrgPerson, or User. organizationalPerson: Provides basic organization-related attributes. inetOrgPerson: Inherits all attributes from organizationalPerson and adds attributes related to internet communication. User: Contains a specific set of attributes that are customized for user accounts in a specific application or organization.
        Synchronization Time Setting	Automatic synchronization	Valid values: Manual synchronization: Synchronizes organizations or users to the service manually. If the source data is updated, you must run the synchronization again to apply the changes. For example, if new employees join your organization, their accounts are not created in the service until you perform another manual synchronization. Automatic synchronization: Automatically synchronizes organizations or users to the service based on a specified frequency and time. You can set the frequency to Daily, Weekly, or Monthly, and select any hour of the day for the synchronization time.

     2. Click Configuration Detection.

     3. Click Synchronize Now.

        After the synchronization is complete, the Import Result is displayed. If an import fails, the reason is shown in the Import Result section.

        

        After the verification is complete, the Verification Result dialog box appears. The dialog box lists the logon name, display name, and verification result of each account in a table. An account that passes verification shows the status Verification successful, pending import. Verify the information, and then click Confirm Import to import the accounts.

     4. Click Confirm Import.

     5. In the Last Synchronization Information section, you can view the Last Synchronization Time and Last Synchronization Status. Click Details for more information.

        

Appendix 1: BaseDN

1. On your LDAP domain controller, open Active Directory Users and Computers.

2. Locate the root directory that you want to sync, for example, chwl. You need to sync all organizational units and users under this directory to Alibaba Cloud Disk Enterprise Edition.

3. Right-click the chwl directory, select Properties, and go to the attribute editor tab.

4. Find the distinguishedName attribute. Double-click it to open the String attribute editor, and then copy the value, for example, DC=chwl,DC=com.

   In the properties dialog box, click the attribute editor tab.

Appendix 2: Administrator DN

1. On the LDAP domain controller, open Active Directory Users and Computers.

2. Find the administrator account that has permissions to access all organizational units and users under the BaseDN. Right-click the account, select Properties, and go to the attribute editor tab.

3. Find the distinguishedName attribute. Double-click the attribute to open the String attribute editor, and then copy the Value. For example, CN=admin,DC=chwl,DC=com.