LDAP and Active Directory Integration

1. Information how to access the LDAP Server for user lookup

• Obtain the ip address and port number of the LDAP server. For the example configuration in the next section we will use the ip address 10.8.0.10 and the default LDAP port number 389.

• A single LDAP user account is needed that has read privileges to the user entries that are to be used for login by OpenMeetings. Often these accounts have the organizational unit attribute ou=system-users.

• Obtain the cn and password of that user from the LDAP administrator. For the example configuration we will use cn=openmeetings and password=12345.

• Obtain the dc values of the root of the LDAP database. In our example we will use dc=mydomain,dc=org.

2. An LDAP config file

• This file needs to be located in the folder $OM_HOME/webapps/openmeetings/data/conf/ ¹. An example file called om_ldap.cfg should come with your OpenMeetings installation.

• The file needs to contain the access information obtained in the previous section. For our example the file would contain the following:

  ldap_conn_host=10.8.0.10
  ldap_conn_port=389
  ldap_conn_secure=false
  
  # The following lines specify the data of the ldap user with
  # read privileges to the user entries according to the LDAP DB.
  ldap_admin_dn=cn=openmeetings,ou=system-users,dc=mydomain,dc=org
  ldap_passwd=12345
  
  # The following line specifies where to search for users wanting to login
  ldap_search_base=ou=users,dc=mydomain,dc=org
  
  # The attribute in the LDAP DB which will be matched against the
  # given login data ("Username or mail address" field) in OpenMeetings:
  ldap_search_query=(uid=%s)
  
  # the scope of the search might be: OBJECT, ONELEVEL, SUBTREE
  ldap_search_scope=ONELEVEL
  
  # Ldap auth type(NONE, SEARCHANDBIND, SIMPLEBIND)
  #  When using SIMPLEBIND a simple bind is performed on the LDAP server to check user authentication
  #  When using NONE, the Ldap server is not used for authentication
  ldap_auth_type=SIMPLEBIND
  
  # userDN format, will be used to bind if ldap_auth_type=SIMPLEBIND
  # might be used to get provisionningDn in case ldap_auth_type=NONE
  ldap_userdn_format=uid=%s,ou=users,dc=mydomain,dc=org
  
  # Ldap provisioning type(NONE, AUTOCREATE, AUTOUPDATE)
  ldap_provisioning=AUTOCREATE
  
  # Ldap deref mode (never, searching, finding, always)
  ldap_deref_mode=always
  
  #  Set this to 'true' if you want to use admin_dn to get user attributes
  #  If any other value is set, user_dn will be used
  ldap_use_admin_to_get_attrs=true
  
  # Ldap-password synchronization to OM DB
  #  Set this to 'true' if you want OM to synchronize the user Ldap-password to OM's internal DB
  #  If you want to disable the feature, set this to any other string.
  #  Defautl value is 'true'
  ldap_sync_password_to_om=true
  
  # Ldap group mode (NONE, ATTRIBUTE, QUERY)
  # NONE means group associations will be ignored
  # ATTRIBUTE means group associations will be taken from 'ldap_group_attr' attribute (M$ AD mode)
  # QUERY means group associations will be taken as a result of 'ldap_group_query' query
  ldap_group_mode=NONE
  
  ldap_group_query=(&(memberUid=%s)(objectClass=posixGroup))
  
  # Ldap user attributes mapping
  # Set the following internal OM user attributes to their corresponding Ldap-attribute
  ldap_user_attr_login=uid
  ldap_user_attr_lastname=sn
  ldap_user_attr_firstname=givenName
  ldap_user_attr_mail=mail
  ldap_user_attr_street=streetAddress
  ldap_user_attr_additionalname=description
  ldap_user_attr_fax=facsimileTelephoneNumber
  ldap_user_attr_zip=postalCode
  ldap_user_attr_country=co
  ldap_user_attr_town=l
  ldap_user_attr_phone=telephoneNumber
  # optional attribute for user picture
  #ldap_user_attr_picture=
  ldap_group_attr=memberOf
  
  # optional, absolute URL will be used as user picture if #ldap_user_attr_picture will be empty
  #ldap_user_picture_uri=picture_uri
  
  # Ldap ignore upper/lower case, convert all input to lower case
  ldap_use_lower_case=false
  
  # Ldap import query, this query should retrieve all LDAP users
  ldap_import_query=(objectClass=inetOrgPerson)
  
  

  NOTE: Directory Servers are individual for every organization, and might use different attribute names than the ones listed in the example config. Please obtain the information about the structure and attribute names of the entries and adjust the config file accordingly.

  It is important to configure LDAP_SEARCH_PATH so that it points to the node of the LDAP directory server that contains the users.

  If there are multiple search paths you can either try to define a search path that points to multiple nodes or define multiple LDAP configurations in the LDAP administration pane of OpenMeetings.

3. Configuring OpenMeetings to use the ldap config file

The final step binds the config file of the previous section to OpenMeetings:

• Log into OpenMeetings as Administrator

• Open Administration->LDAP

  

• In the right pane of the main window labeled “LDAP Config” set the Name of the LDAP DB which you want to appear in the popup menu right of the “Domain” label of OpenMeeting's login screen. Any Name can be set here.

• Check the “Enabled” checkbox to make the LDAP DB available on the login screen.

• Fill in the field “Config file name” with the file name of the config file from the previous section of this manual (just the file name, without it's path).

• Save the Configuration by clicking in the save icon above the “LDAP Config” label and load this setting by clicking in the reload icon right of the save icon.

• The table in the left pane of OpenMeeting's LDAP administration window should contain an entry with the ID (autoassigned by OpenMeetings), name and config file.

Test the settings by logging out of Openmeetings and logging back in with a user and password of the LDAP DB. Make sure you select the configured name of the LDAP DB in the “Domain” popup menu of the Login screen before pressing the “Sign in” button. If login doesn't work, see the section Troubleshooting