#LDAP

7

The Lightweight Directory Access Protocol (LDAP) is an open, vendor-neutral, industry-standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol network.

Some key points are emphasized in this article in order to save your time to get linux ldap client in cache working with windows AD (active directory) LDAP server.
The first thing to do is to get successful TLS connection to windows AD.
Raw tcp case is beyond of this article, there is no problem with it, it is trivial.
Windows ldap server uses port 636 for tls and this port can be used to get ldap certificate.
As we will see later there is reason for this.
linux ldap client uses STARTTLS special ldap extension to switch plain tcp to TLS only.

9 2
1 2,137

I was recently asked whether we have a function to convert LDAP date time stamps into $HOROLOG format or other formats and the answer is not at the moment, but there is a simple method to do the conversion.

Let us look at the facts and figures involved...

1) Active Directory's (AD) date 0 (zero) is 1601-01-01 00:00:00.000 or January 1st, 1601 at midnight (00:00:00)

2) AD timestamps are calculated as the number of 100 nanosecond intervals from date 0

3) 864000000000 is the number of 100 nanosecond intervals per day

5 0
0 811

From the first glance, the task of configuring LDAP authentication in Caché is not hard at all – the manual describes this process in just 6 paragraphs. On the other hand, if the LDAP server uses Microsoft Active Directory, there a few non-evident things that need to be configured on the LDAP server side. Those who don’t do anything like that on a regular basis may get lost in Caché settings. In this article, we will describe the step-by-step process of setting up LDAP authentication and cover the diagnostic methods that can be used if something doesn’t work as expected.

4 3
2 1,755
Question
Mathew Burt · Oct 19, 2016
LDAP Adapter - Credentials?

I'm writing an operation to use the LDAP Outbound Adapter to query AD.

The operation's settings include a basic Credentials selector, to allow you to use the built in Credentials function of Ensemble. This can be referenced in the operation with ..Adapter.Credentials

1 6
0 565
Question
Scott Roth · Jun 29, 2018
Adding TLS to ZAUTHENTICATE

I wrote a ZAUTHENTICATE.mac a couple of months back, and found recently that it is creating coredumps on almost a nightly basis. I think I have figured out this problem to be not clearing out my MsgSearch after I am doing 2 of them within the code.

1. Get User Attibutes from AD

2. Get User Groups From AD

So while I am trying to cleanup the code I thought it would be a good time to add a Certificate and TLS to the mix since I should of been using that all along. However I keep running into issues

1 14
0 372

Currently, I am working on a CSP application that is supposed to generate reports. Users will have varying access to said reports. To achieve that, I plan to use LDAP (because it's used in other systems where those users already exist). Documentation does not provide enough information, so I'd like a clarification:
Do I need to enable LDAP authentication for the whole Cache instance to use LDAP authentication in a single CSP application in that instance?

0 5
0 147

In preparation for a presentation I need a  real-world LDAP schema that has been customized a bit beyond the basics.   Perferably this would be based on an OpenLDAP system which would make it easier to merge into this presentation. 

 

If you have such a schema you would be willing to share please respond or contact my directly at Rich.Taylor@InterSystems.com

Thanks in advance.

Rich Taylor

0 1
0 266
Question
sansa stark · Sep 13, 2018
Authentication Error

Hi All,
I tried to execute the ##Class(%SYS.LDAP).Binds(LD,"",$lb(Username,Domain,Password),$$$LDAPAUTHNEGOTIATE) but this command is returning the value as 7 only instead of 0,7 is an "Authentication Method Not Supported",How to recover it and why this error message is occuring
Please help me

0 3
0 300

Presenter: Rich Taylor
Task: Use an LDAP schema that differs from the provided default
Approach: Give examples of customized LDAP schema development, using LDAP APIs and ZAUTHORIZE
 

In this session we explore the various options of for working with LDAP as an authentication and authorization framework. We will look beyond the simple LDAP schemas into working with more complex LDAP configurations that incorporate application level security information.

 

Content related to this session, including slides, video and additional learning content can be found here.

0 1
0 364

Reference: sample LDAP code routine LDAP.mac

Some IF statements reference macro $$$WindowsCacheClient as a boolean flag to mark if the client calling the LDAP server is running Windows. Other IF statements reference $$$ISWINDOWS. Are they not the same thing? That is, does the routine need $$$WindowsCacheClient at all?

Examples:

#define WindowsCacheClient 1

0 2
0 125
Question
sansa stark · Oct 9, 2018
SID Conversion

Hi all,By using LDAP cache method ##Class(%SYS.LDAP).GetValuesLen(LD,CurrentEntry,Attribute) we get the list of attributes but in "ObjectSid" attribute have the SID in binary format(objectSid^U¤:c@ãºþÕLCP]). how to convert to the readable format from the binary format in cache side.
Please help us to proceed further

0 3
0 235

we have a issue with just the 1 namespace, where users log using ldap but arent getting any roles assigned to them.

Ldap does work as the user account is created as a ldap user. 

I have gone through the various settings to check that all is setup as required, but cant find a reason why the roles arent being assigned. 

0 1
0 90

Hi There, 

I am reaching out to the community to see if anyone has implemented SSO via SAML into TrakCare from Azure AD? 

Also looking to see if anyone has come across automated role provisioning, I have seen this from an IRIS perspective but not directly into TrakCare. 

Thanks in Advance

Cheers, 

TC

 

 

 

0 2
0 85

Has anyone worked out a way to use LDAP to define the default namespace on multiple servers?  I know that documentation says that intersystems-Namespace-xxx only supports one namespace, but how is this useful?   Any workaround to say have  intersystems-Namespace-server1-namespaceA  and intersystems-Namespace-server2-namespaceB?  Is it best practice to use the same "namespace" on every server?

Thanks!

0 1
0 185

Hi Group, I've followed the instructions from the documentation to configure LDAP and Ensemble to authenticate, however, I'm unable to authenticate using an account in the LDAP.  The user is able to authenticate in a Linux shell.  I have added the ObjectClass of IntersystemsAccount and the 3 group definitions to the schema.  Other than adding the user to this group, do I have to change the user's objectClass at all?  

This is not on active directory - it is a Linux based LDAP solution (slapd).

0 3
0 676
Question
Scott Roth · Jan 23, 2019
Single Sign On (SSO)

Does Intersystems specifically Ensemble support a Single Sign On architecture? Currently we are using Delegated sign on using LDAP and TLS, however our CIO would like us to move toward a single sign on, so when you sign into your PC it would automatically pass the credentials to Ensemble.

Thanks

Scott

0 3
0 821

Hi,

I am getting the following error while logging in using LDAP authentication,

"An error occurred with the CSP application and has been logged to system error log (^ERRORS)". I've set the connection up and using Authentication Test  was successful. I seem to be able to login as well but keep getting that error. If I allows unauthenticated access then the page works but changing it to LDAP is not working.

The LDAP account once created in Cache has U access to the resource related with the web application.  

0 1
0 532

Hello everyone,

 

i am in process of changing our authentication method, so we can integrate our AD authentication in our programs. At the moment i am using they %SYS.LDAP object, and trying to use the .Bind() method with the user information to authenticate. This seems to work without issues, but here the problems start.

0 1
0 284

I am working through trying to use ZAUTHENTICATE.mac and LDAP.mac to do Delegated sign on into Ensemble. In reading over the samples and the documentation, I am not clearly finding on how to set the Appropriate Role from the LDAP group I return. Can someone help explain this part to me? If I have a user sign on, and I return a "Group" from the Authentication, how do I get that to transform into the Role I need for Ensemble.

Thanks

Scott Roth

0 1
0 447

Hi,
I am facing issue during LDAP lookup like whenever I used product group parameter in AD explorer to search data from application I am getting empty result. If I set product group parameter as null then based on distinguished name result is generated in application. So if anyone knows about how LDAP works and how parameters are set in AD explorer then please let me know.

Thanks in advance.

0 1
0 210