LDAP Configuration
DATPROF Runtime provides the ability to import LDAP users and use them for authentication.
The configuration for the LDAP integration can be found in the users page of the runtime toolbar.
The properties can be saved here and DATPROF Runtime provides a way to validate the imported users before synchronization. After synchronization, any imported users
will be able to log in to DATPROF Runtime by using their ldap username or email, and LDAP password.
The users will be periodically synchronized with the LDAP directory so usernames and user details are always in sync. The synchronisation interval is configurable from this page as well.
(Important: The runtime instance should be restarted for the new synchronisation interval to take effect, the other configuration options can be changed on the fly)
Configuration
This section will explain the different configuration options for setting up a successful ldap integration
LDAP url
This is the main url pointing to your running LDAP server. the format should be "ldap://{url}:{port}"
LDAP base
This is the base dn which is the point from which the server will look for users. the base is prepended to the authentication base and the user search base.
LDAP username
The LDAP user username used to login to the LDAP server. This does not need to be an admin account. Simple read privileges are sufficient.
LDAP password
The LDAP user password.
LDAP authentication base
This is the base dn which is used for user authentication.
LDAP user search base
This is base dn which is used for finding users.
LDAP user filter
This is the filter that can be used to further filter users on specific properties.
The following link can be used for more information on how to configure this filter.
LDAP Search filter cheat sheet
LDAP synchronization interval in minutes
This configuration option contains the interval that the DATPROF Runtime server uses to synchronize the LDAP users with the local database. (important: changing this value requires a restart for the changes to take effect)
Test filter
The test filter button can be used to test the given ldap configuration. It will attempt to connect with the provided connection details and retrieve a list of users using the user search base and user search filter.
Using LDAP over SSL
LDAP over SSL is supported, but without configuration Runtime will return the following error:
[Root exception is javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]
In order to use secure LDAP, you will need to import the certificate used for SSL into your JRE cacerts file. This file can be found in your runtime installation under runtime\jdk\lib\security. Copy your SSL certificate to this folder.
extending our path to include the keytool
## By default, the keytool is not a part of PATH. We will need to add it.
set path=%path%;<your file explorer's path to the runtime folder>\jdk\bin
example:
set path=%path%;C:\Users\yoeri\Documents\DATPROF\Runtime\runtime-4.3.0\jdk\bin
Now that we can use the keytool, let's make the security folder our active directory.
Moving our current directory
cd <your system path to the Runtime security folder>
example:
cd C:\Users\yoeri\Documents\DATPROF\Runtime\runtime-4.3.0\jdk\lib\security
You can use the cacerts file to store your certificates.
The cacerts file is protected by a password. The default password of the cacerts file is changeit. You should change this password into you own.
Changing the keystore password
keytool -storepasswd -keystore cacerts
Enter keystore password: changeit
New keystore password: new-password
Re-enter new keystore password: new-password
Now, let's list the contents of our cacerts file.
Listing existing cacerts content
keytool -list -v -keystore cacerts
enter keystore password:new-password
You should now see a large amount of text print. These are all the existing certificates in cacerts. Now, we'll add our certificate.
Importing our certificate into cacerts
keytool -import -alias <the name of your certificate without its file extension> -keystore cacerts -file <the full file name of your certificate + extension>
example:
keytool -import -alias certificate -keystore cacerts -file certificate.crt
>Trust this certificate? [no]: yes
Certificate was added to keystore
Alternatively you can store your certificate elsewhere and supply a system path to this location for the -file command.
After this has been done, and your LDAP settings in Runtime have been adjusted to the right connection strings, LDAP over SSL will work. Restart Runtime to load your changes.
Don't forget to change your LDAP port to 636 (the default SSL port), and to change the LDAP url in your Runtime configuration to start with ldaps:// instead of ldap://