Drive and Photo Service:LDAP configuration

Enable the LDAP configuration.

1. Log on to CDE and go to the admin console.

2. In the left-side navigation pane, choose exclusive logon configuration > LDAP configuration, and then turn on the LDAP configuration switch.

Configure the server connection information.

1. On the LDAP configuration page, configure the Server connection information.

   The following table describes the parameters.

   Parameter	Example value	Description
   server address	ldap://120.XX.XX.XX	The LDAP server address. The address must start with ldap://. Valid formats include: IP address: ldap://120.XX.XX.XX Domain name: ldap://www.example.com
   port number	389	The default port number is 389. If you use a custom port, enter the modified port number.
   BaseDN	DC=chwl,DC=com	Specifies the scope for synchronization. You can only sync organizational units and users within this base distinguished name (DN) to Alibaba Cloud Disk Enterprise Edition. For instructions on how to obtain the BaseDN in a Windows AD environment, see Appendix: Obtain server connection information in a Windows environment. Important Enter this value carefully and do not change it after the initial setup. If you modify the BaseDN after syncing data between Alibaba Cloud Disk Enterprise Edition and your LDAP or AD server, the directory paths may no longer match, causing synchronization to fail.
   administrator DN	CN=admin,DC=chwl,DC=com	Enter the full distinguished name (DN) of the administrator account. This account must have permissions to access all organizational units and users under the specified BaseDN. For instructions on how to obtain the administrator DN in a Windows AD environment, see Appendix 2: Obtain the administrator DN.
   Password	*****	Enter the password for the administrator account in your LDAP system. The Alibaba Cloud Disk Enterprise Edition server uses this account to log on to your LDAP system to synchronize and authenticate users.
   Type	Windows AD	Select the type of your directory server. Options are Windows AD, OpenLDAP, and Other. The Other option refers to any server that uses the LDAP protocol.

2. Click Test Connection. A Connection Successful message appears.

   If the test fails, check your parameter configuration and ensure no firewall is blocking the server address and port.

3. Click Next.

Configure logon information.

1. On the LDAP configuration page, configure the logon information.

   The following table describes the parameters.

   Parameter	Example value	Description
   logon username field	sAMAccountName	The attribute used as the logon username. This must match the corresponding attribute in the LDAP attribute editor.
   display name field	displayName	The attribute used as the user's display name in the cloud disk. This must match the corresponding attribute in the LDAP attribute editor.

2. Click Next.

(Optional) Configure synchronization options.

• If you do not need to enable LDAP synchronization, skip this step. If you enable only LDAP logon without synchronization, any LDAP user in your organization can log on to Alibaba Cloud Disk Enterprise Edition. The system automatically creates an account for them upon their first logon, but no organizational structure is imported.

• If you enable synchronization, you can import users and the organizational structure from your LDAP server. Follow these steps:

  1. On the synchronization configuration page, turn on the synchronization configuration switch and configure the settings.

     The following table describes the parameters.

     Note

     • To sync both LDAP organizations and users, you must configure settings for both teams and users.

     • To sync only LDAP organizations, configure the settings for teams.

     • To sync only LDAP users, configure the settings for users.

     Parameter	Example value	Description
     team object classes	organizationalUnit	An Organizational Unit (OU) is an AD container for users, groups, computers, and other OUs. It is the smallest scope to which you can assign Group Policy settings or delegate administrative authority. The group object class is not supported.
     user object classes	User	You can enter organizationalPerson, inetOrgPerson, or User. organizationalPerson provides basic organization-related attributes. inetOrgPerson provides all attributes of organizationalPerson and adds attributes for internet communication. User contains a specific set of attributes customized for user accounts in a particular application or organization.
     Synchronization time settings	Automatic Synchronization	Specifies how to synchronize data. Valid values: Manual synchronization: Manually syncs organizations or users to the cloud disk. If the source data is updated after a manual sync, the cloud disk does not automatically reflect the changes. You must run the synchronization again. For example, if new employees are added to your directory, they cannot log on to the cloud disk until you perform another manual sync. Automatic synchronization: Syncs organizations or users to the cloud disk at a scheduled frequency and time. You can set the frequency to daily, weekly, or monthly, and select any hour of the day for the synchronization to occur.

  2. After the synchronization is complete, the Import results appear. If an import fails, the reason is shown in the Import results.

     In the Validation results dialog box, review the logon names, display names, and validation status of the users to be imported. After you confirm that all records show Validation successful, pending import, click Confirm import to import the users.

  3. In the last synchronization information section, you can view the Last synchronization time and Last synchronization status. Click Details on the right to view details about the last synchronization.

On the enterprise exclusive logon page, click AD/LDAP.

You can now log on to Alibaba Cloud Disk Enterprise Edition with your LDAP username and password.

On your LDAP domain controller, open Active Directory Users and Computers.

Locate the root directory that you want to sync, for example, chwl. You need to sync all organizational units and users under this directory to Alibaba Cloud Disk Enterprise Edition.

Right-click the chwl directory, select Properties, and go to the attribute editor tab.

Find the distinguishedName attribute. Double-click it to open the String attribute editor, and then copy the value, for example, DC=chwl,DC=com.

In the properties dialog box, click the attribute editor tab.

On the LDAP domain controller, open Active Directory Users and Computers.

Find the administrator account that has permissions to access all organizational units and users under the BaseDN. Right-click the account, select Properties, and go to the attribute editor tab.

Find the distinguishedName attribute. Double-click the attribute to open the String attribute editor, and then copy the Value. For example, CN=admin,DC=chwl,DC=com.