LDAP connection behavior¶
LDAP connections behave in the following ways:
- A new Group Membership Process automatically adds users to groups based on permissions associated with the group. This process runs at the end of every LDAP Synchronization job, and automatically whenever you Publish if any of your changes impact Users, Groups, or Permissions tabs.
- Attribute mapping has been extended to handle constants, manual entry, and mapping both LDAP organizational units and LDAP group names.
- A single LDAP connection is designed to gather all the information needed to create the user and to synchronize the user’s attribute data from LDAP. Relevant organizational unit information and security group membership can be mapped to the user’s attributes stored in aPriori. In this way the automated Group Membership Process can associate the user to the correct Access Control groups.
-
The user’s provenance can either be “Manual”, an LDAP connection, or blank.
-
Manual means that LDAP connections should not modify this user (changes are managed by admins through the UI).
- LDAP connection name means that the named connection will manage this user; other connections will ignore it.
- Blank should be a temporary value that is used for users that are intended to be managed by an LDAP connection. When the user is provisioned properly in LDAP, a sync will pick this user up. We do not want to put the connection name in since if the user is not yet provisioned in LDAP, a sync will not find the user and LDAP map/sync will remove the user from the aPriori database.
Note:
When you import users from a spreadsheet and a user’s provenance is changed from LDAP to either blank or Manual, their password is reset to the default value provided during spreadsheet import. The user is prompted with a Reset Password dialog during the next login.
You can manually invoke LDAP connections one at a time through the UI (“LDAP Map”), or multiple connections can be run in an automated sync job (“LDAP Sync”, which requires the separately licensed LDAP Synchronization module). When using LDAP Map, the administrator can invoke all or some of the connections and can process the additions, modifications, and deletions after each connection is synced. For an LDAP Sync job, the connections that are contained in the scheduled job are run and the changes are published.
When you run the LDAP Map, you must publish the changes to the database by clicking the Publish Changes icon in the toolbar.
Rules that describe the connection logic¶
The following rules describe the connection logic during a sync (both manual and automated).
-
User is returned by the sync and the user already exists
- User’s provenance matches the LDAP connection or the user’s provenance is blank then the user is updated and all attributes (including the user’s provenance if it is blank) is updated; the user is added to the modify list.
-
User is returned by the sync and the user does not already exist
- The user is created and all attributes are updated including setting the provenance; user is added to the addition list.
-
User is returned by the sync and the user’s provenance does not match the LDAP connection
- The user is not updated.
-
User is returned by the sync and the user’s provenance is “Manual”
- The user is ignored (not put on the modified list either).
-
User is not returned but the user’s provenance matches the LDAP connection
- The user is marked for deletion (i.e. put on the deletion list).
-
User is not returned, and the user’s provenance does not match the LDAP connection, or it is blank
- The user is ignored.
The following table summarizes this behavior in terms of the System Admin and Digital Factory Admin checkboxes on the aPriori tab of the LDAP Connection dialog box:
| Conditions of users | Conditions of users | Conditions of users |
|---|---|---|
| Same Provenance | Different Provenance | |
| Users returned by LDAP qry | group membership impact - see following table | ignored |
| Users NOT returned by LDAP qry | removed from aP | ignored |
| Changes for users returned by LDAP query AND have matching or blank Provenance | Changes for users returned by LDAP query AND have matching or blank Provenance | Changes for users returned by LDAP query AND have matching or blank Provenance | Changes for users returned by LDAP query AND have matching or blank Provenance |
|---|---|---|---|
| Admin groups: System Admin/Digital FactoryAdmin | |||
| Checked | Unchecked | ||
| Sync Admin Group Membership | checked | added to group (or remain in group) | removed from group if a member |
| Sync Admin Group Membership | unchecked | no changes | no changes |
The addition, modification and deletion lists are processed when the Publish button is clicked.
To change the connection for whick a user is provisioned, an admin changes the user’s provenance field, then clicks Publish and runs that newly-specified connection.
Multiple LDAP connections¶
The behavior of how LDAP Map or LDAP Sync handle multiple connections has not changed, except that they do not manage group membership anymore. In general, an individual user is provisioned by a single connection. If a user is returned by more than once connection, LDAP sync uses the connection that matches the value of the user’s Provenance field. If the provenance is blank, the provenance is set to the connection that has returned the user.