LDAP Tools
LDAP administration section and automatic user synchronization tool |
Type | XAR |
Category | |
Developed by | Jerome Velociter |
Rating | |
License | GNU Lesser General Public License 2.1 |
Table of contents
Description
LDAP configuration section
This is simply a UI that exposes the LDAP configuration properties.
You can refer to http://platform.xwiki.org/xwiki/bin/view/AdminGuide/Authentication#HLDAPAuthentication and http://platform.xwiki.org/xwiki/bin/view/AdminGuide/LDAPAuthenticationUseCases for more information about LDAP configuration in XWiki.
Option | xwiki.cfg analog | Default | Description meaning |
---|---|---|---|
Ldap | xwiki.authentication.ldap | off | Turn LDAP authentication on - otherwise only XWiki authentication |
Ldap server adress | xwiki.authentication.ldap.server | - | LDAP Server (Active Directory, eDirectory, OpenLDAP, etc.) |
Ldap server port | xwiki.authentication.ldap.port | - | |
Ldap login matching | xwiki.authentication.ldap.bind_DN | - | LDAP login, empty = anonymous access, otherwise specify full dn |
Ldap password matching | xwiki.authentication.ldap.bind_pass | - | |
Validate Ldap user/password | xwiki.authentication.ldap.validate_password | off | Bypass standard LDAP bind validation by doing a direct password comparison. |
Ldap group filter | xwiki.authentication.ldap.user_group | - | only members of the following group will be verified in the LDAP |
Ldap group to exclude | xwiki.authentication.ldap.exclude_group | - | [Since 1.5RC1, XWikiLDAPAuthServiceImpl] only users not member of the following group can authenticate |
Ldap base DN | xwiki.authentication.ldap.base_DN | - | base DN for searches |
Ldap UID attribute name | xwiki.authentication.ldap.UID_attr | cn | Specifies the LDAP attribute containing the identifier to be used as the XWiki name |
Try local login | xwiki.authentication.ldap.trylocal | off | [Since 1.3M2, XWikiLDAPAuthServiceImpl] if ldap authentication fails for any reason, try XWiki DB authentication with the same credentials |
Update user from LDAP | xwiki.authentication.ldap.update_user | [Since 1.3M2, XWikiLDAPAuthServiceImpl] on every login update the mapped attributes from LDAP to XWiki otherwise this happens only once when the XWiki account is created. | |
Ldap user fiels mapping | xwiki.authentication.ldap.fields_mapping | - | retrieve the following fields from LDAP and store them in the XWiki user object (xwiki-attribute=ldap-attribute) |
Ldap groups mapping | xwiki.authentication.ldap.group_mapping | - | [Since 1.3M2, XWikiLDAPAuthServiceImpl] XWiki.XWikiAdminGroup=cn=AdminRole,ou=groups,o=MegaNova,c=US| XWiki.Organisation=cn=testers,ou=groups,o=MegaNova,c=US |
LDAP groups members cache | xwiki.authentication.ldap.groupcache_expiration | 3600*6 | [Since 1.3M2, XWikiLDAPAuthServiceImpl] time in seconds after which the list of members in a group is refreshed from LDAP |
LDAP groups sync mode | xwiki.authentication.ldap.mode_group_sync | always | [Since 1.3M2, XWikiLDAPAuthServiceImpl] |
LDAP synchronization feature
Configuring the synchronization frequencies
The LDAP synchronization relies on the Scheduler Application. It bring two scheduler jobs :
- One is responsible to start a synchronization cycle. It's name in the scheduler job table is Start LDAP synchronization cycle. Its default cron configuration is 0 0 2 * * ?, which means every night at 2 A.M.
- The other one is responsible to execute batches of user account synchronization. It's name in the scheduler job table is Execute LDAP synchronization batch. It's default configuration is 0 0/5 * * * ?, meaning every five minutes.
You can change the frequency of execution of each of the two jobs to better fit your need. Don't forget to unschedule and reschedule the jobs you edit in order for the new settings to take effect. Also, don't forget that LDAP group members are cache, for 6 hours as a default setting (see the parameter xwiki.authentication.ldap.groupcache_expiration). If you have a synchronization frequency higher than the cache purge frequency, you will not see the synchronization effects as expected.
Other configuration options
Option name | Description |
---|---|
Synchronize groups defined in the LDAP group mapping | If set to true, members from all groups defined in the XWiki <-> LDAP group mapping (parameter group_mapping) will be synchronized. |
Other groups to synchronize | You might want to synchronize more groups than those defined in your group mapping. You can list them here, separated by a new line |
Page to use for storing the list of accounts that remains to be synchronized | This parameter allows to set a custom page used as a marker of accounts that remains to be synchronized. You usually don't have to change this, and can leave it blank. |
Page to use for writing the synchronization logs | You can precise which page should be used to log the details about synchronization operations. You usually don't have to change this, and can leave it blank. |
Override the synchronization list when non empty | It is not recommended to activate this option. It allows to force starting a new synchronization cycle when its jobs triggers, but the previous cycle is not finished (some accounts are still listed to be synchronized) |
Number of accounts to synchronize per batch | Defines how many accounts should be synchronized per batch. It is recommended to have this number relatively low (in combination with the batch frequency) for the initial synchronization since all users will trigger an account creation. It can then be set to a higher value in cruse mode, since most users should not trigger an update anymore : only new users, users with update profile or group memberships will trigger an update |
Prerequisites & Installation Instructions
For the synchronization feature :
- You need to ensure the document XWiki.AdminLdapSyncSheet is saved by a user with programming access level
- You need to ensure the two scheduler jobs (namely XWiki.LdapFetchUsersToSynchronize and XWiki.SynchronizeLdapUsers) have sufficient rights (they should be saved by a user with programming access level) and are actually scheduled.