Setting up LDAP Authentication in search mode with Microsoft Active Directory.
Article ID: KB0093401
Updated On:
| Products | Versions |
|---|---|
| TIBCO API Exchange | - |
| Not Applicable | - |
Description
Most AD LDAP restrict bind mode. One needs to use admin user and password to attach with LDAP and then search for incoming sAMAccountName.
Below is a sample setting for an AD.
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
#LDAP namespace. Used to verify user name token. This configuration is for search mode.
com.tibco.trinity.runtime.core.provider.authn.ldap.serverURL=ldap://<IP:PORT>
com.tibco.trinity.runtime.core.provider.authn.ldap.securityAuthentication=simple
com.tibco.trinity.runtime.core.provider.authn.ldap.initialCtxFactory=com.sun.jndi.ldap.LdapCtxFactory
com.tibco.trinity.runtime.core.provider.authn.ldap.userSearchBaseDN=<SEARCHBASEDN>
com.tibco.trinity.runtime.core.provider.authn.ldap.userAttributeUsersName=cn
#com.tibco.trinity.runtime.core.provider.authn.ldap.userAttributesExtra=mail,givenname
com.tibco.trinity.runtime.core.provider.authn.ldap.userSearchScopeSubtree=true
com.tibco.trinity.runtime.core.provider.authn.ldap.keyPassword=<ADMINUSER PASSWORD>
com.tibco.trinity.runtime.core.provider.authn.ldap.keyAlias=<ADMINUSER DN>
com.tibco.trinity.runtime.core.provider.authn.ldap.userSearchExpression=sAMAccountName={0}
# Credential provider configuration to provide details for ldap admin user/admin password.
com.tibco.trinity.runtime.core.provider.authn.ldap.credentialProvider=class:com.tibco.trinity.runtime.core.provider.credential.password
com.tibco.trinity.runtime.core.provider.credential.password.usernameToken=<ADMINUSER DN WITH \>,<ADMINUSER PASSWORD>
com.tibco.trinity.runtime.core.provider.credential.password.protectionParameter=<ADMINUSER PASSWORD>>
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Note that com.tibco.trinity.runtime.core.provider.credential.password.usernameToken must be provided with slashes such as cn=Administrator\,ou=Users\,dc=globalsupport instead of cn=Administrator,ou=Users,dc=globalsuppor. There must be no "\" (backward slash) at the end. Check with LDAP admin for basedn and user search expression parameters.
Issue/Introduction
Feedback
