PRO LDAP AD

The server must have the PHP module for LDAP installed. It is added to the auto-installation, but if you see an error indicating its absence, install it on the server with the command:

apt install php8.3-ldap

To connect Totum to your LDAP server, fill in the ttm__ldap_settings table:

• h_host — LDAP server host

• h_port — LDAP server port. Usually 389.

  If your internal network configuration has multiple domains on different hosts, these parameters are passed in an array in h_domains_settings (see further) to a specific domain. If the parameter is passed in h_domains_settings, it will be used from there. If not, it will be taken from the general settings:

  • h_host -› host
  • h_port -› port
  • h_version -› version
  • h_ssl -› ssl
  • h_cert_file -› cert_file
  • h_bind_format -› bind_format [at|dn]
  • h_login_param -› login_param
  • h_fio_param -› fio_param
  • h_email_type -› email_type [bind|param]
  • h_email_param -› email_param
  • h_get_groups -› get_groups
  • h_group_param -› group_param

• h_version — if the field is not filled, {"LDAP_OPT_PROTOCOL_VERSION":"3"} is used, but you can set custom PHP connection settings in key-value format.

• h_ssl — check the box if you need to verify the LDAP server's SSL certificate.

• h_cert_file — upload two .key and .crt certificate files if the LDAP server uses a certificate issued by a non-public certification authority.

• h_ldap_on — enable after configuring all parameters.

  Important! Do not enable until you have verified the connection's functionality.

• h_domains_settings — domain settings (one or more)

  • 

  • You can fill in the default example with the right button.

  • The domain is specified in the top key (fully with dots):

  • DC=totum,DC=local — should be specified as totum.local

  • user — the login of the user who has access to search in this domain.

  • pass — the password of the access user.

    If the server supports anonymous requests, user and pass may be absent. They should be absent, not just empty!

  • basedn — the base DN where the filtering will be performed. If you don't know what this is, set the DN of the specified domain.

    For AD, you cannot simply set the DN equal to the domain. Either a more specific OU where the search will be performed must be specified, or the parameter "LDAP_OPT_REFERRALS": "0", must be passed in the h_versions field. More details here.

  • filter — the search filter based on which users will be selected from the LDAP server:

  • // example for AD server
    (&(objectCategory=Person)(memberOf=CN=totum,OU=AccessGroup,DC=totum,DC=local)(!(useraccountcontrol:1.2.840.113556.1.4.803:=2)))
    

  • // example for unix
    (uid=*)
    

  • Documentation on search filters in AD: https://social.technet.microsoft.com/...

  • filter_single — the search filter by which a single user will be searched by their login:

  • // for AD
    (&(objectCategory=Person)({USER_LOGIN_PARAM}={USER_LOGIN}))
    

  • // for unix
    ({USER_LOGIN_PARAM}={USER_LOGIN})
    

  • Two value replacements are used:

    • {USER_LOGIN_PARAM} — will be taken from h_login_param.

    • {USER_LOGIN} — will be the user's login.

• h_bind_format — the format of user binding on the LDAP server:

  • @ type — for AD servers

  • dn type — for Linux servers (in this case, in h_domains_settings — domain — user] the dn of the access user must be specified)

  For DN-type authorization, the modes of creating users “Load on first bind” in h_user_processing_type are not available. Only preloading!

• h_domain_selector — the type of domain switcher on the authorization page (see further for the authorization sequence):

  • Hidden

  • Totum/LDAP

  • Totum/Domain list

• h_login_param — which parameter is the login on your password server.

  • The standard value for AD is sAMAccountName, which can be filled in with the right button.

  • For Linux systems, it is likely to be dn.

• h_fio_param — what to record in FIO in the Totum users table. It can be changed directly in Totum. It will be updated from Ldap only if this parameter changes in Ldap.

• email type for recording in the Totum users table:

  • From bind: login@domain.zone — the email will be formed from the login and domain.

  • From param — the email will be taken from the parameter on the LDAP server specified in h_email_param.

  • In both cases, the email can be changed directly in Totum. It will be updated from Ldap only if it changes in Ldap.

• h_show_result — checks the connection with the entered values. You can get data from the Ldap server considering the group search parameters with the right button.

• h_user_processing_type — determines when users will be created in Totum:

  • Load on first bind — users will not be pre-created in Totum, only at the moment of successful binding.

  • Load on first bind with role matching — the user will be authorized and created in Totum only with a successful bind and role matching.

  • All found users — users will be loaded and created in Totum when h_import_users is pressed, regardless of role matching. If there is no role match, such users will have empty roles.

  • Only with matching roles — users will be loaded and created in Totum when h_import_users is pressed only if they have matching roles.

• h_get_groups — group retrieval settings. Additional requests will be made for each user with the substitution of {USER_DN}, and the result will be placed in the specified key (for AD, it can be filled in with the right button):

  • Empty — do not load groups.

  • get direct group membership:

  groups: (&(objectCategory=group)(member={USER_DN}))
  

  • get indirect group membership (for cases where groups are nested within groups):

  all_groups: (&(objectCategory=group)(member:1.2.840.113556.1.4.1941:={USER_DN}))
  

• h_group_param — the parameter that will be requested when performing h_get_groups and by which group matching will occur. For AD, CN is usually used.

• h_import_users — imports users (adds and updates) from Ldap to Totum according to the settings.

  Features of creating a user in Totum

  The Totum login for ldap-users is empty.

  The value ldap is set in the ttm__auth_type field.

  The login in ldap in the format loginParam@domain.zone is recorded in a separate field ttm__extparams (data type) + DN and loaded parameters are also recorded there + roles assigned according to the matching rules.

• h_update_one_user — adds and updates a single user.

• h_generate_cron — creates a cron job in the Crons table, which presses the h_import_users button according to the schedule.