Prerequisite
An available LDAP/AD server is already set up.
Precaution
You can only configure one LDAP/AD server in AOC.
Procedure
| Parameter | Description |
|---|---|
| Server type | Select the server type to be configured:
|
| Name | Enter the name of the server. |
| Description (optional) | Enter a description for the server. |
| Parameter | Description |
|---|---|
| Primary server address | Enter the IP address or domain name of the primary server. |
| Encryption | Choose whether to enable encryption. |
| CA certificate (optional) | This option is displayed only if encryption is enabled. You can click the ellipsis (...) in the upper right corner of the LDAP/AD page, select Upload CA certificate to upload the CA certificate for the authentication and communication encryption between the server and AOC. You can change the CA certificate after uploading it. |
| Primary server port | Enter the port of the primary server. |
| Secondary server | Choose whether to enable the secondary server. After enabling, if the primary server is down or unreachable during user login verification, the system will automatically switch to the secondary server for access. |
| Secondary server address | This option is displayed only if the secondary server is enabled. Enter the IP address or domain name of the secondary server. |
| Secondary server port | This option is displayed only if the secondary server is enabled. Enter the port of the secondary server. |
| Base DN | Defines the scope of LDAP/AD users synchronized to AOC. |
| Bind DN (optional) | Enter the username for logging in to the LDAP/AD server. The user corresponding to this username should have query permissions to the LDAP/AD server. |
| Bind password (optional) | Enter the bind password corresponding to the bind DN. |
| Filter (optional) | Set filter conditions for users in the range defined by the base DN. Users defined in the filter conditions will not be synchronized to AOC. |
After completing the server configuration, the system will test the connectivity between AOC and the server. If the connectivity is normal, you can configure the mapping rules. By setting the mapping rules between the user information in the server and the user information in AOC, you can import the user information from the server into AOC, or assign roles to users synchronized to AOC according to the set rules.
For more information about user information and roles in AOC, refer to the AOC users and permissions chapter.
Procedure
Configuring basic information mapping
Fill in the Name, Username, Phone number (optional), and Email address (optional) attributes from the LDAP/AD server, and the values of these attributes will be used as the LDAP/AD user's name, username, phone number, and email address in AOC.
For example, if you need to import the information of a user named Alice Smith from the LDAP/AD server into AOC, the mapping relationship and synchronization process are shown as follows:
The basic information mapping is configured as:
Configuring role mapping
Assign roles for users synced to Arcfra Operation Center
Click Add mapping rule, set the matching criterion for users in the LDAP/AD server, and select a role in AOC. LDAP/AD users that meet the matching criterion will be assigned the selected role after being synchronized to AOC.
Default role:
Custom role
Note:
You need to set different matching criteria for different roles.
Since the LDAP/AD server can group users by either ou or group, when entering the matching criterion, determine whether the group for the target users is defined by ou or group to ensure the correct format for the matching criterion:
If the users are grouped by ou, you need to obtain the RDN value rdn value of the group and filter the users with rdn:dn:=rdn value.
For example:
dev group, and the group DN value is OU=dev,DC=aoc,DC=io, then the RDN value of this group will be dev, and the matching criterion will be ou:dn:= dev.
Note:
The above method applies only to the LDAP server.
dev group, and the group RDN value is the RDN value of the organizational unit (OU) to which the group belongs, and the user's DN value is CN=Betty,OU=dev,DC=aoc,DC=io, then the RDN value rdn value of this group will be dev, and the matching criterion will be (&(ou:dn:=dev)(cn=Betty)).If the users are grouped by group, you need to obtain the DN value groupDn of the group and filter the users with memberOf=groupDn.
For example:
Suppose that you need to filter all users from the Singapore group, and the group DN value is CN=Singapore,OU=arcfra,DC=arcfra,DC=local, then the matching criterion will be memberOf=CN=Singapore,OU=arcfra,DC=arcfra,DC=local.
Note:
When filtering users with
memberOf= groupDn, the filtered users must have thememberOfattribute.
Suppose that you need to filter a single user Alice from the Singapore group, and the value of the user's memberOf attribute is CN=Domin Admins,CN=Singapore,DC=aoc,DC=arcfra,DC=arcfra,DC=com, then the matching criterion will be (&(memberOf=CN=Domin Admins,CN=Singapore,DC=aoc,DC=arcfra,DC=arcfra,DC=com)(cn=Alice)).
For users outside criterion:
For LDAP/AD users that are outside of any matching criterion but within the base DN range, you can handle them in one of the following ways:
Click Save to save the server configuration and automatically synchronize users in the specified range to AOC. You can view the users synchronized to AOC in the User management page. The users' creation source will be LDAP/AD.