Integration model
Authentication
Anjana Data interacts with the identity manager via the LDAP protocol, through which it will validate the credential provided by the user.
The functionality is directly embedded in the Zeus authentication management microservice; it is enabled and configured through that microservice's configuration file.
LDAP authentication mechanism implemented
-
https://docs.ldap.com/specs/rfc4513.txt
Authentication configuration
The various authentication providers used are configured in the security.authentication property.
In the case of LDAP, the following properties must be configured:
security:
authentication:
ldap:
#Authentication type for login (can be USER_PASSWORD, USER_PASSWORD_ENC and USER_CONNECTION)
user-authentication: XXX
#Ldap url and port
url: ldap://ldapservice:10389
#The base DN of the schema
base-dn: dc=anjanadata,dc=org
#The class that users have
user-structural-class: person
#The attribute where the username of the users is
user-search-attribute: cn
#The filter to use for login (only necessary if user-authentication is USER_PASSWORD_ENC)
user-search-filter: (cn={0})
The following properties are optional:
security:
authentication:
ldap:
#The administrative user to perform queries against the ldap
connection-user-dn: uid=admin,ou=system
#The administrative user's password
connection-user-password: XXX
#The attribute where the employee number or identifier is
employee-search-attribute: employeeNumber
#The attribute where the employee's first name is
name-search-attribute: givenName
#The attribute where the employee's last name is
surname-search-attribute: sn
#The attribute where the employee's title is
title-search-attribute: title
#The attribute where the employee's phone number is
phone-search-attribute: telephoneNumber
#Maximum time in ms to establish the TCP connection with the LDAP server (default: 5000)
connect-timeout-ms: 5000
#Maximum time in ms to receive the LDAP server's response per operation/page (default: 60000)
read-timeout-ms: 60000
The timeouts apply per operation (not in total). In paginated synchronizations with large directories (e.g. 80,000 users with pages of 500 entries), each page has its own independent timeout. Increase read-timeout-ms if the LDAP server is slow returning pages.
Active governance
In general, Anjana Data's DSAs will be represented as groups, and the signatories of those DSAs will be members of those groups. Tot's plugins assign permissions in the technologies connected to that LDAP by mapping those permissions directly against these groups that represent the DSAs.
Required credentials
Authentication
A credential is required that allows:
-
Performing user credential validation (bind)
-
Retrieving user information
LDAP authentication mechanism implemented
-
https://docs.ldap.com/specs/rfc4513.txt
Active governance
Required credential documented in the "Tot plugin LDAP" plugin