LDAP Adapter - Credentials?

Question

Question

Mathew Burt · Oct 19, 2016

I'm writing an operation to use the LDAP Outbound Adapter to query AD.

The operation's settings include a basic Credentials selector, to allow you to use the built in Credentials function of Ensemble. This can be referenced in the operation with ..Adapter.Credentials

But when it comes to specifying the credentials in the Bind method, the documentation indicates that only a format of $lb(Username,Domain,Password) is supported. I tried ..Adapter.Credentials and $lb(..Adapter.Credentials) but the only thing that worked was setting the three variables in plain text first in the operation itself (e.g. set Username="abc", etc).

Even if I could get the reference to the adapter credentials to work - Ensemble credentials don't include a separate Domain field, only a Username and Password.

Is the adapter's credentials selector a red herring? Or can it be made to work?

Discussion (6)1

Log in or sign up to continue

Katherine Reid · Nov 2, 2016

I think you may be looking at the wrong class documentation.

There are two LDAP classes - %Net.LDAP.Client and %SYS.LDAP. The EnsLib.LDAP.OutboundAdapter is written using %Net.LDAP.Client.Session, which does not have a Binds method. The %SYS.LDAP class does have a Binds method, and discusses wanting a $lb like you've described.

2 0

Marcel den Ouden · Nov 2, 2016

The credentials do not have space to store a Domain field. Maybe add the domain as an extra setting?

Property Domain As %String ;

Parameter SETTINGS = "Domain";

Then you can use ..Domain in your Business Operation. You might also need to subclass the adapter to get it working with the Domain.

1 0

score 1 · Answer 1 · 2016-11-02T15:49:43-04:00

Hi Matthew -

Have you tried:

set credentials = ##class(Ens.Config.Credentials).%OpenId(..Adapter.Credentials)

Then you can use:

credentials.Username and credentials.Password.

But there's no domain, sorry.

score 0 · Answer 2 · 2016-11-03T13:41:08-04:00

Mathew Burt · Nov 3, 2016

Thanks Michael, that's a handy bit of code, worked great :)

0 0

score 0 · Answer 3 · 2016-11-03T13:43:05-04:00

Thanks for letting me know Katherine, I guess I've just written a method which isn't actually using the adapter at all. I'll check out the %Net.LDAP.Client documentation and see if I can rework it.

score 0 · Answer 4 · 2016-11-03T13:48:05-04:00

Thanks Marcel, that's a good idea. That'd work well I think if we needed to store credentials for many different domains. However we only have one domain in our organisation - my concern was around declaring/storing the username and password in plain text in the code, whereas I wouldn't mind doing that for the domain.

However, that said, I wasn't aware until now that the credentials stored in Ensemble could be pulled back in plain text using that code. I assumed as they're obfuscated in the front end that they'd be encrypted in some fashion, but the code Michael provided can be used to trace them out in plain text (or write them out in Terminal). Not as secure as I'd imagined, but still somewhat of a step up from writing them in the method's code.