Enabling LDAP authentication for Unravel UI

You can configure lightweight directory access protocol (LDAP) by

Using UPN lookup and Group lookups using DN.
sAMAccount name to match users.

Simple configuration using UPN lookup and Group lookups using DN

This configuration example is for the newer implementation of Unravel with MS Active Directory and for objects located in separate OUs. In this method, the user lookup is on login ID appended with the configured domain defined in the properties to make UPN (User Principal Name) for the lookup.

Note

This configuration does not:

Work if objects in the directory do not have the expected UPN format.
Include bindDn and password, which older implementations used.

Important

You must substitute your local values for the parameters and values used in the following examples.

Contact your LDAP Admin if you do not know the following directory information.

Stop Unravel.

<Unravel installation directory>/unravel/manager stop

Check that the object can be found and the user is part of the expected groups.

ldapsearch -v -h ariel.unraveldata.com -p 389 -D CN=sethbind,OU=seth,DC=unraveldata,DC=com -w unraveldata1! -b DC=unraveldata,DC=com -s sub "(userPrincipalName=commauser@unraveldata.com)"

Set the properties for LDAP authentication as follows:

<Unravel installation directory>/unravel/manager config properties set <property> <value>

For example:

##LDAP
<Unravel installation directory>/unravel/manager config properties set com.unraveldata.login.mode ldap
<Unravel installation directory>/unravel/manager config properties set com.unraveldata.ldap.url ldap://ariel.unraveldata.com
<Unravel installation directory>/unravel/manager config properties set com.unraveldata.ldap.baseDN DC=unraveldata,DC=com
<Unravel installation directory>/unravel/manager config properties set com.unraveldata.ldap.use_jndi true
<Unravel installation directory>/unravel/manager config properties set com.unraveldata.ldap.verbose true

##LDAP groups
<Unravel installation directory>/unravel/manager config properties set com.unraveldata.ldap.groupFilter seth-test-group,seth-test-admingroup
<Unravel installation directory>/unravel/manager config properties set com.unraveldata.login.admins.ldap.groups seth-test-admingroup

Refer to LDAP properties for the complete list.

Apply the changes.

<Unravel installation directory>/unravel/manager config apply

Start Unravel

<Unravel installation directory>/unravel/manager start

Advanced configuration where UPN cannot be used

This configuration uses the sAMAccount name to match users. Using the Manager tool, set the bindDN and password in the properties. It uses CN to match groups instead of DN, which was used in the example above. The configuration uses bind user to get groups, then matches it using CN to filter out groups located in com.unraveldata.ldap.groupFilter, and assign admin users specified in com.unraveldata.login.admins.ldap.groups.

Important

You must substitute your local values for the parameters and values used in the following example.

Please contact your LDAP Admin if you don't know the following directory information.

Stop Unravel.

<Unravel installation directory>/unravel/manager stop

Check that the object can be found and the user is part of the expected groups.

ldapsearch -v -h ariel.unraveldata.com -p 389 -D 
CN=sethbind,OU=seth,DC=unraveldata,DC=com -w unraveldata1! -b 
DC=unraveldata,DC=com -s sub "(sAMAccountname=commauser)"

Set the properties for LDAP authentication as follows:

<Unravel installation directory>/unravel/manager config properties set <property> <value>

For example:

#LDAP
<Unravel installation directory>/unravel/manager config properties set com.unraveldata.login.mode ldap
<Unravel installation directory>/unravel/manager config properties set com.unraveldata.ldap.url ldap://ariel.unraveldata.com
<Unravel installation directory>/unravel/manager config properties set com.unraveldata.ldap.baseDN DC=unraveldata,DC=com
<Unravel installation directory>/unravel/manager config properties set com.unraveldata.ldap.use_jndi true
<Unravel installation directory>/unravel/manager config properties set com.unraveldata.ldap.verbose true
<Unravel installation directory>/unravel/manager config properties set com.unraveldata.ldap.bind_dn CN=sethbind,OU=seth,DC=unraveldata,DC=com
<Unravel installation directory>/unravel/manager config properties set com.unraveldata.ldap.bind_pw unraveldata1!
<Unravel installation directory>/unravel/manager config properties set com.unraveldata.ldap.guidKey sAMAccountName 

#LDAP groups
<Unravel installation directory>/unravel/manager config properties set com.unraveldata.ldap.groupFilter seth-test-group,seth-test-admingroup
<Unravel installation directory>/unravel/manager config properties set com.unraveldata.ldap.groupMembershipKey member
<Unravel installation directory>/unravel/manager config properties set com.unraveldata.ldap.groupQueryFilter (CN=seth*)
<Unravel installation directory>/unravel/manager config properties set com.unraveldata.login.admins.ldap.groups seth-test-admingroup

Refer to LDAP properties for the complete list.

Apply the changes.

<Unravel installation directory>/unravel/manager config apply

Start Unravel

<Unravel installation directory>/unravel/manager start

Note

To use LDAP with RBAC see Configure LDAP or SAML RBAC Properties.

What is the difference between the two group properties in LDAP configurations?

com.unraveldata.ldap.groupFilter: Lists the groups Unravel looks in for users who are allowed to log in.
com.unraveldata.login.admins.ldap.groups: Lists the groups Unravel looks in for users who are allowed to log in as admins.

Important

com.unraveldata.login.admins.ldap.groups is a subset of com.unraveldata.ldap.groupFilter, i.e., a group defined in com.unraveldata.login.admins.ldap.groups must also be defined in com.unraveldata.ldap.groupFilter.

For example,

com.unraveldata.ldap.groupFilter=secs-lab-admins,secs-lab-users
# the admins.ldap group is also defined in ldap.groupFilter
com.unraveldata.login.admins.ldap.groups=secs-lab-admins

If a user is:

Not listed in the groups defined in com.unraveldata.ldap.groupFilter, they cannot log in.
Listed in group defined in com.unraveldata.login.admins.ldap.groups, they are logged in as an admin.
Only listed in the groups defined in com.unraveldata.ldap.groupFilter, they are logged in as a non-admin user.

LDAP properties

LDAP

These properties are required when com.unraveldata.login.mode=ldap.

Property/Description	Unit	Default
com.unraveldata.ldap.Domain	string	-
com.unraveldata.ldap.bind_dn LDAP bind DN is a login of an LDAP user that can access Base DN. Used only with Base DN.	string	-
com.unraveldata.ldap.bind_pw Password for the user-defined as Bind DN	string	-
com.unraveldata.ldap.baseDN LDAP base DN; use your rootDN value if a custom LDAP query is applied. Needed for Open LDAP. See also com.unraveldata.ldap.userDNPattern below as an alternative.	string	-
com.unraveldata.ldap.customLDAPQuery A full LDAP query that LDAP Atn provider uses to execute against LDAP Server. If this query returns a null result set, the LDAP Provider fails the Authentication request, succeeds if the user is part of the resultset. If this property is set, filtering and group properties are ignored.	string	-
com.unraveldata.ldap.groupClassKey LDAP attribute name on the group entry that is to be used in LDAP group searches.	string	group
com.unraveldata.ldap.groupDNPattern COLON-separated list of patterns to use to find DNs for group entities in this directory. Use %s where the actual group name is to be substituted for. Each pattern should be fully qualified. When using this property you must unset com.unraveldata.ldap.domain.	string	-
com.unraveldata.ldap.groupFilter COMMA-separated list of LDAP Group names (short name not full DNs). If you wish to have LDAP admins, you must define at least one group of admins. See com.unraveldata.login.admins.ldap.groups. Example: secs-lab-admins,secs-lab-users	CSL	-
com.unraveldata.ldap.groupMembershipKey LDAP attribute name on the user entry that references a group that the user belongs to. Default is 'member'.	string	member
com.unraveldata.ldap.groupSearchMethods The lookup function list and order definitions of LDAP groups. Allowed values are OID, member-of, and member. These can be specified in any order.	string	OID, member-of, member
com.unraveldata.ldap.guidKey LDAP attribute name whose values are unique in this LDAP server. Default is "uid"; not used when the custom query is specified.	string	-
com.unraveldata.login.admins.ldap.groups The group(s) of LDAP admins. The group(s) must be listed in com.unraveldata.ldap.groupFilter. Example: secs-lab-admins	CSL	-
com.unraveldata.ldap.mailAttribute The mail attribute name in the LDAP response that Unravel server uses to extract the ldap user's email address. If not configured, Unravel server uses the attribute name "mail".	string	mail
com.unraveldata.ldap.realUserAttribute Enables a secondary LDAP lookup. When the AD object does not have the available email string, Unravel needs to do a second lookup to retrieve the user's email address. This email address is used by AutoActions when sending an email to the apps old.	string	uid
com.unraveldata.ldap.userDNPattern COLON-separated list of patterns to use to find DNs for users in this directory. Use %s where the actual group name is to be substituted for. This is used as a list of baseDNs and baseDN is ignored if this is set.	string	-
com.unraveldata.ldap.userFilter COMMA-separated list of LDAP usernames (just short names, not full DNs).	string	-
com.unraveldata.ldap.url The URL for the LDAP server. Can be multiple servers with a space separator. The standard port is used if unspecified. Example: ldap://host ldaps://hostldap://host:9999 ldaps://host1:9999 ldaps://host2:9999	string	-
com.unraveldata.ldap.verbose Enables verbose logging. Grep for "Ldap" entries in the `unravel_ngui.log` file under `/usr/local/unravel/logs/`. `true`: user names and group names can appear in this log, but raw passwords are not logged. `false`: logging turned off.	boolean	false

In this section:

Home

Enabling LDAP authentication for Unravel UI

Simple configuration using UPN lookup and Group lookups using DN

Note

Important

Advanced configuration where UPN cannot be used

Important

Note

What is the difference between the two group properties in LDAP configurations?

Important

LDAP properties

LDAP

Search results