LDAP

Configuring LDAP Authentication

The LDAP Membership extension provides connectivity/subscription to an existing LDAP implementation for authentication, user profiles and group memberships. To authenticate and authorize a user Infiniti LDAP will request the following of the LDAP server:

• Authentication - Confirmation that a username and password credentials are correct. Depending on the LDAP implementation the username may require a domain.
• User Profile Query - User profile attributes such as names, emails etc.
• User Group Memberships Query - A list of groups that the user is a member of.
• Parent Group Memberships Query (recursive) - list of groups that a particular group is a member of (recursive).

As LDAP implementations are not standard the query filters can be configured to suit the environment.

How to Install LDAP

By default Infiniti Installations use Forms Authentication as the licensing and an administrator group must be set before LDAP can be configured.

Step 1 - Identify and configure and LDAP Infiniti administrator group.
When the first user (usually a server administrator) is authenticated, Infiniti needs to assign them permissions so they can access appropriate functionality. If this step is not completed users will not be able to actually do anything post authentication. Use the article below to configure an external group.

External Authentication User Groups

Step 2 Modify the Produce and Manage Appsettings.Json files
From the Infiniti Web server open the Produce appsetings.json. file (usually similar to c:\inetpub\wwwroot\Infiniti\Produce\appsetings.json)
Firstly, Locate the Extensions Array, and add the following, line,
("Intelledox.Extension.IdentityBuiltin.LDAPIdentity, Intelledox.Extension.IdentityBuiltin")

Now Locate or create an Authentication/LDAP object, this is where the environment specific properties will be set. At a minimum add an "LdapPath" property, additonal properties are describe in the tables below.

Your AppSettings file should look similar to the below.

{
  "ConnectionStrings": {
    "DefaultConnection": "Password=infiniti;Persist Security Info=True;User ID=infiniti;Initial Catalog=Infiniti;Data Source=server1234"
  },
  "Extensions": [
    "Intelledox.Extension.DatasourceBuiltin.OleDbDatasource, Intelledox.Extension.DatasourceBuiltin",
		...
    ...
      "Intelledox.Extension.IdentityBuiltin.LDAPIdentity, Intelledox.Extension.IdentityBuiltin"
  ],
  "Authentication": {
    "LDAP": {
      "LdapPath": "LDAP://ldapServer",
      "Username": "myServiceAccount",
      "Password": "qwerty78"
    }
  }
}

General Properties

Provide at least an LdapPath for the connection to LDAP.

User Authentication Properties

The Authentication properties allow the specification of the auth type and also the format of the username.

LDAP Query Properties

Settings for validating the user’s supplied credentials.

User Profile Query

Query to retrieve user data such as name, email, address etc.

Group Membership Attribute

Use when groups memberships are sourced from the above user profile. (DEFAULT)

Group Membership Entities Query

Use when group memberships are sourced from a separated query

Parent Groups

Recursive query to search for parent groups

LDAP SYNC

Logging

Where logging is configured, results are stored in the Infiniti database. Can be retrieved using the following SQL statement.

SELECT TOP(10)*
FROM EventLog
ORDERBY [DateTime] DESC