This is an automated email from the ASF dual-hosted git repository.
solomax pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/openmeetings.git
The following commit(s) were added to refs/heads/master by this push:
new 26a085c [OPENMEETINGS-2258] added new LDAP Configuration in markdown
format. (#61)
26a085c is described below
commit 26a085c92d31af3756b8e89444e959c810cd28ec
Author: ormf <[email protected]>
AuthorDate: Sun Apr 19 03:32:08 2020 +0200
[OPENMEETINGS-2258] added new LDAP Configuration in markdown format. (#61)
- updated openmeetings-server/src/site/resources/images/ldap_screen.png
- deleted openmeetings-server/src/site/xdoc/LdapAndADS.xml
Co-authored-by: Orm Finnendahl <[email protected]>
---
.../src/site/markdown/LdapAndADS.md | 238 +++++++++++++++++++++
.../src/site/resources/images/ldap_screen.png | Bin 104512 -> 123234 bytes
openmeetings-server/src/site/xdoc/LdapAndADS.xml | 96 ---------
3 files changed, 238 insertions(+), 96 deletions(-)
diff --git a/openmeetings-server/src/site/markdown/LdapAndADS.md
b/openmeetings-server/src/site/markdown/LdapAndADS.md
new file mode 100644
index 0000000..fc32b7c
--- /dev/null
+++ b/openmeetings-server/src/site/markdown/LdapAndADS.md
@@ -0,0 +1,238 @@
+<!--
+# Licensed under the Apache License, Version 2.0 (the "License")
http://www.apache.org/licenses/LICENSE-2.0 -->
+
+# LDAP and Active Directory Integration
+
+This manual explains the configuration to use an already existing
+(e.g. corporate or university) LDAP/AD Server for user authentication
+into OpenMeetings. Successful integration has also been reported with
+Novell eDirectory.
+
+For installation and setup instructions of an LDAP server itself see
+https://help.ubuntu.com/lts/serverguide/openldap-server.html
+
+## LDAP Configuration in OpenMeetings
+
+To configure access to an LDAP Server, three things are needed:
+
+### 1. Information how to access the LDAP Server for user lookup
+
+- Obtain the ip address and port number of the LDAP server. For the
+ example configuration in the next section we will use the ip
+ address 10.8.0.10 and the default LDAP port number 389.
+
+- A single LDAP user account is needed that has read privileges to the
+ user entries that are to be used for login by OpenMeetings. Often
+ these accounts have the organizational unit attribute
+ `ou=system-users`.
+
+- Obtain the cn and password of that user from the LDAP
+ administrator. For the example configuration we will use
+ `cn=openmeetings` and `password=12345`.
+
+- Obtain the dc values of the root of the LDAP database. In our
+ example we will use `dc=mydomain,dc=org`.
+
+### 2. An LDAP config file
+
+- This file needs to be located in the folder
+ `$OM_HOME/webapps/openmeetings/data/conf/` <sup><a id="fnr.1"
class="footref" href="#fn.1">1</a></sup>.
+ An example file called `om_ldap.cfg` should come with your
+ OpenMeetings installation.
+
+- The file needs to contain the access information obtained in the
+ previous section. For our example the file would contain the
+ following:
+
+ ```
+ ldap_conn_host=10.8.0.10
+ ldap_conn_port=389
+ ldap_conn_secure=false
+
+ # The following lines specify the data of the ldap user with
+ # read privileges to the user entries according to the LDAP DB.
+ ldap_admin_dn=cn=openmeetings,ou=system-users,dc=mydomain,dc=org
+ ldap_passwd=12345
+
+ # The following line specifies where to search for users wanting to login
+ ldap_search_base=ou=users,dc=mydomain,dc=org
+
+ # The attribute in the LDAP DB which will be matched against the
+ # given login data ("Username or mail address" field) in OpenMeetings:
+ ldap_search_query=(uid=%s)
+
+ # the scope of the search might be: OBJECT, ONELEVEL, SUBTREE
+ ldap_search_scope=ONELEVEL
+
+ # Ldap auth type(NONE, SEARCHANDBIND, SIMPLEBIND)
+ # When using SIMPLEBIND a simple bind is performed on the LDAP server to
check user authentication
+ # When using NONE, the Ldap server is not used for authentication
+ ldap_auth_type=SIMPLEBIND
+
+ # userDN format, will be used to bind if ldap_auth_type=SIMPLEBIND
+ # might be used to get provisionningDn in case ldap_auth_type=NONE
+ ldap_userdn_format=uid=%s,ou=users,dc=mydomain,dc=org
+
+ # Ldap provisioning type(NONE, AUTOCREATE, AUTOUPDATE)
+ ldap_provisioning=AUTOCREATE
+
+ # Ldap deref mode (never, searching, finding, always)
+ ldap_deref_mode=always
+
+ # Set this to 'true' if you want to use admin_dn to get user attributes
+ # If any other value is set, user_dn will be used
+ ldap_use_admin_to_get_attrs=true
+
+ # Ldap-password synchronization to OM DB
+ # Set this to 'true' if you want OM to synchronize the user Ldap-password
to OM's internal DB
+ # If you want to disable the feature, set this to any other string.
+ # Defautl value is 'true'
+ ldap_sync_password_to_om=true
+
+ # Ldap group mode (NONE, ATTRIBUTE, QUERY)
+ # NONE means group associations will be ignored
+ # ATTRIBUTE means group associations will be taken from 'ldap_group_attr'
attribute (M$ AD mode)
+ # QUERY means group associations will be taken as a result of
'ldap_group_query' query
+ ldap_group_mode=NONE
+
+ ldap_group_query=(&(memberUid=%s)(objectClass=posixGroup))
+
+ # Ldap user attributes mapping
+ # Set the following internal OM user attributes to their corresponding
Ldap-attribute
+ ldap_user_attr_login=uid
+ ldap_user_attr_lastname=sn
+ ldap_user_attr_firstname=givenName
+ ldap_user_attr_mail=mail
+ ldap_user_attr_street=streetAddress
+ ldap_user_attr_additionalname=description
+ ldap_user_attr_fax=facsimileTelephoneNumber
+ ldap_user_attr_zip=postalCode
+ ldap_user_attr_country=co
+ ldap_user_attr_town=l
+ ldap_user_attr_phone=telephoneNumber
+ # optional attribute for user picture
+ #ldap_user_attr_picture=
+ ldap_group_attr=memberOf
+
+ # optional, absolute URL will be used as user picture if
#ldap_user_attr_picture will be empty
+ #ldap_user_picture_uri=picture_uri
+
+ # Ldap ignore upper/lower case, convert all input to lower case
+ ldap_use_lower_case=false
+
+ # Ldap import query, this query should retrieve all LDAP users
+ ldap_import_query=(objectClass=inetOrgPerson)
+
+ ```
+
+ NOTE: Directory Servers are individual for every organization, and
+ might use different attribute names than the ones listed in the
+ example config. Please obtain the information about the structure
+ and attribute names of the entries and adjust the config file
+ accordingly.
+
+ It is important to configure LDAP_SEARCH_PATH so that it points to the
+ node of the LDAP directory server that contains the users.
+
+ If there are multiple search paths you can either try to define a
+ search path that points to multiple nodes or define multiple LDAP
+ configurations in the LDAP administration pane of OpenMeetings.
+
+### 3. Configuring OpenMeetings to use the ldap config file
+
+The final step binds the config file of the previous section to
+OpenMeetings:
+
+- Log into OpenMeetings as Administrator
+
+- Open Administration->LDAP
+
+ <img src="../resources/images/ldap_screen.png"></img>
+
+- In the right pane of the main window labeled "LDAP Config" set
+ the Name of the LDAP DB which you want to appear in the popup
+ menu right of the "Domain" label of OpenMeeting's login
+ screen. Any Name can be set here.
+
+- Check the "Enabled" checkbox to make the LDAP DB available on the
+ login screen.
+
+- Fill in the field "Config file name" with the file name of the
+ config file from the previous section of this manual (just the
+ file name, without it's path).
+
+- Save the Configuration by clicking in the save icon above the
+ "LDAP Config" label and load this setting by clicking in the
+ reload icon right of the save icon.
+
+- The table in the left pane of OpenMeeting's LDAP administration
+ window should contain an entry with the ID (autoassigned by
+ OpenMeetings), name and config file.
+
+Test the settings by logging out of Openmeetings and logging back in
+with a user and password of the LDAP DB. Make sure you select the
+configured name of the LDAP DB in the "Domain" popup menu of the Login
+screen before pressing the "Sign in" button. If login doesn't work,
+see the section [Troubleshooting](#ldap-troubleshooting)
+
+## Additional (optional) steps
+
+Once login with users from the LDAP DB works, all users of that
+database can get imported into OpenMeetings internal table of users
+using the command line tool "admin.sh":
+
+- First test with:
+
+ `$OM_HOME/admin.sh -l -d1 --print-only`
+
+ The argument of the `-d` ("domain-id") flag indicates the ID number
+ of the LDAP DB in the LDAP table on the left pane in OpenMeeting's
+ Administration->LDAP configuration. If only one LDAP DB is
+ configured there the ID most probably is 1.
+
+ `--print-only` indicates that the entries shouldn't actually get
+ imported, but rather printed out on the terminal.
+
+ If everything works as expected, a lot of printout should happen
+ on the terminal with the user entries of the LDAP DB appearing
+ last.
+
+- In that case the entries can actually get imported into
+ OpenMeetings by omitting `--print-only`:
+
+ `$OM_HOME/admin.sh -l -d1`
+
+After import they can be found in the OpenMeeting website at
+appopriate places (Invitation into rooms, in the Administration
+pages of Users, Groups and Conference rooms, etc.).
+
+NOTE: It is not strictly necessary to import all users from the LDAP
+DB: Any user who logs into OpenMeeting for the first time will be
+added to OpenMeeting's Users table. For administrative purposes it
+can nevertheless be very convenient to import all users of an LDAP
+DB in order to distribute them to different Groups/Rooms without
+requiring each of them to log in first.
+
+<a id="ldap-troubleshooting" href="#ldap-troubleshooting"></a>
+
+## Troubleshooting
+
+In case login doesn't work it is recommended to turn on verbose
+logging:
+
+- stop OM
+
+- add the following line to
`$OM_HOME/webapps/openmeetings/WEB-INF/classes/logback-config.xml`:
+
+ `<logger name="org.apache.directory" level="DEBUG" />`
+
+- restart OM
+
+- Try to log in using the configured LDAP DB and try to debug the
+ problem by checking the log file. By default, logging is done to the
+ file `$OM_HOME/logs/catalina.out`.
+
+## Footnotes
+
+<sup><a id="fn.1" href="#fnr.1">1</a></sup> `$OM_HOME` is the
+home folder of the OpenMeetings installation, e.g. `/opt/open503`
diff --git a/openmeetings-server/src/site/resources/images/ldap_screen.png
b/openmeetings-server/src/site/resources/images/ldap_screen.png
index 4e44820..de013e3 100644
Binary files a/openmeetings-server/src/site/resources/images/ldap_screen.png
and b/openmeetings-server/src/site/resources/images/ldap_screen.png differ
diff --git a/openmeetings-server/src/site/xdoc/LdapAndADS.xml
b/openmeetings-server/src/site/xdoc/LdapAndADS.xml
deleted file mode 100644
index 612020d..0000000
--- a/openmeetings-server/src/site/xdoc/LdapAndADS.xml
+++ /dev/null
@@ -1,96 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
- -->
-<document xmlns="http://maven.apache.org/XDOC/2.0";
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
- xsi:schemaLocation="http://maven.apache.org/XDOC/2.0
http://maven.apache.org/xsd/xdoc-2.0.xsd";>
- <properties>
- <title>LDAP/ADS configuration</title>
- <author email="[email protected]">Apache
OpenMeetings Team</author>
- </properties>
-
- <body>
- <section name="Ubuntu Installation">
- <div>
- Run the commands
- <source>
-<![CDATA[
-sudo apt-get install slapd ldap-utils
-]]>
- </source>
- </div>
- <div>
- Modify file <tt>/etc/ldap/ldap.conf</tt> add
highlighted attributes:
- <source>
-<![CDATA[
-#
-# LDAP Defaults
-#
-# See ldap.conf(5) for details
-# This file should be world readable but not world writable.
-BASE dc=unixmen,dc=com
-URI ldap://192.168.1.200
-#SIZELIMIT 12
-#TIMELIMIT 15
-#DEREF never
-# TLS certificates (needed for GnuTLS)
-TLS_CACERT /etc/ssl/certs/ca-certificates.crt
-]]>
- </source>
- </div>
- <div>
- Run the Configuration assistant: <tt>sudo
dpkg-reconfigure slapd</tt>
- </div>
- <div>
- Test LDAP server: <tt>ldapsearch -x</tt>
- </div>
- <div>
- Add/Edit/Delete users: <tt>sudo apt-get install
phpldapadmin</tt>
- </div>
- <div>
- Detailed reference: <a
href="http://www.unixmen.com/openldap-installation-and-configuration-in-ubuntu-12-10-server-debian-6/";>http://www.unixmen.com/openldap-installation-and-configuration-in-ubuntu-12-10-server-debian-6/</a>
- </div>
- </section>
- <section name="LDAP and Active Directory Integration">
- <p> In: $OM_HOME/webapps/openmeetings/data/conf<br/>
- you will find sample configurations for LDAP
and Active Directory. The
- nature of those Directory Servers are that they
are individual for
- every organization, so you have to modify of
course at least the
- path to your user-base et cetera.<br/>
- <br/>
- To activate any of those configurations you
have to login into
- OpenMeetings, goto Administration > Ldap.
- </p>
- <a class="fancybox-buttons"
href="images/ldap_screen.png">
- <img src="images/ldap_screen.png" alt=""
width="442" height="282" />
- </a>
- <p>
- Import is that you configure LDAP_SEARCH_PATH
so that it points to the node of your directory server that contains the users
- </p>
- <p>
- If you have multiple search paths you can
either try to define a search path that points to multiple nodes or define
multiple ldap configurations.
- </p>
- <p>
- Successful integration is also reported with
Novell eDirectory
- </p>
- <p>
- You can configure multiple domains or different
user-paths in the Administration of OpenMeetings.
- </p>
- <p>
- <b>NOTE: </b>You should specify file name
<i>RELATIVE</i> to <tt>$OM_HOME/webapps/openmeetings/conf</tt>
- </p>
- </section>
-
- </body>
-</document>
\ No newline at end of file
