LDAP Authentication
LDAP authentication is available only if you have technical module
HOPEX Power Supervisor.
An LDAP directory enables storage of user data of the enterprise.
HOPEX Administration allows you to create users authenticated at LDAP server level.
Accessing LDAP server management
To access LDAP server management:
From the
Administration desktop, select the
LDAP Servers sub-folder.
Configuring LDAP authentication
To configure LDAP authentication:
1. Create an LDAP server in HOPEX Administration.
2. Specify parameters of your LDAP server.
3. (Optional) You can:
• configure LDAP parameters
• modify LDAP import parameters
4. Check the configuration of the LDAP server.
When LDAP authentication has been configured:
• you can import persons from the LDAP directory.
• or you can manually map a HOPEX user group with a user group declared in your LDAP server.
When connecting to
HOPEX, the authentication service uses the
HOPEX Login and password of the user to authenticate the user with the list of available LDAP servers.
Creating an LDAP server
The LDAP server is the server on which the LDAP directory is installed.
The LDAP directory can be an Active Directory directory.
To create an LDAP server:
1. Access LDAP server management.
2. In the LDAP server menu bar, click
New 
.
3. In the creation of LDAP server dialog box, enter the Name of the LDAP server and click OK.
The new LDAP server appears in the list of LDAP servers.
Configuring the LDAP server
LDAP server configuration is restricted to users with a HOPEX Administrator or User management Administrator profile.
To configure an LDAP server:
Prerequisite: the LDAP server is already created.
1. Access the LDAP server management pages.
2. Select the new LDAP server and click
Properties 
.
3. In Characteristics, complete the following fields:
• LDAP Server Name: name of the server hosting the LDAP directory.
• LDAP Port: LDAP communication bridge
Example: 389
• LDAP Root Address: root address of LDAP server. This is an important attribute to limit query for a user in the LDAP directory or to address a particular forest.
• LDAP Identifier: this is the LDAP attribute enabling unique identification of a user
Example: SAMAccountName, UID
• LDAP SSL Encryption: select “Yes” if you want LDAP directory connection to be SSL protocol encoded
• LDAP Anonymous Connection: if you select “No”, you must specify the user via which LDAP directory connection will be made, as well as the user password
Only an administrator user can connect anonymously to an LDAP server.
• LDAP User: enter the identifier of the LDAP user used for LDAP directory connection. If connection is anonymous, this field should not be completed.
This user must have reading rights on data that
HOPEX needs to access (example: LDAP person group, membership of a group in LDAP, e-mail in LDAP, etc.).
• Authentication Password: enter the password of the LDAP user used for LDAP directory connection. If connection is anonymous, this field should not be completed.
•
4. Click Save.
The LDAP server is configured.
You can also:
Configuring an LDAP parameter
An LDAP parameter is a parameter that exists in the LDAP directory and is associated uniquely with a HOPEX attribute.
Configuring an LDAP parameter is useful when importing persons from an LDAP directory. This configuration enables initialization of attributes (of the person or login created in HOPEX) corresponding to parameters with values stored in the LDAP directory.
Example: the "E-mail address" MetaAttribute of the person is initialized with the "mail" LDAP parameter of the person in the "Active Directory" LDAP directory (if mapping has been carried out).
To configure an LDAP parameter:
1. Access the LDAP server management pages.
2. Select the LDAP server for which you want to configure an LDAP parameter and click
Properties 
.
3. In
LDAP Parameters,
click
New 
.
The LDAP parameter enables pre-completion of characteristics of a person corresponding to the LDAP parameters.
4. Enter the
Name of the LDAP parameter (example: Mail), then click
Properties 
.
5. (Optionally, access the "expert" metamodel) Select Index on Persons, so that the parameter value enables unique identification of a person. If a person in HOPEX has the same e-mail as a person defined in the LDAP directory, this person is reused (instead of creating a new person and risk duplicating the same person).
6. (Optionally, access the "expert" metamodel) Select Is available for search so that an e-mail address can be entered in the import entry area.
Example: if you enter ctodd@mega.com, you should find Clara TODD.
7. In the MetaAttribute field, click the arrow and select Connect MetaAttribute.
8. Execute a query on the MetaAttribute (example: E-mail).
When importing persons from the LDAP directory, the LDAP parameter (example: mail) will initialize the MetaAttribute (example: E-mail address).
Modifying LDAP directory import content
You can modify LDAP directory import content:
• export candidate objects:
This option enables definition of the type of objects to be imported from the LDAP directory.
Default value: person.
• the list of objects browsed for LDAP query
This option enables addition to the import of a particular person and/or persons of a team ("organization").
Default value: organization,organizationalUnit,person
To define content of LDAP directory import:
1. Access environment options.
2. In the options tree, expand the Installation folder and select User Management.
3. (Optional) In the right pane, modify the List of ObjectClass candidates for import from LDAP option.
To import objects other than persons (default value), for example resources or org-units, specify this in this field. Objects should be separated by commas.
Everything that is imported creates occurrences of persons with login.
4. (Optional) In the right pane, modify the List of ObjectClass browsed for LDAP query option.
To add a person or organization to the import, enter the name of the person or organization (example: Quality) in the field.
The result is the list of ObjectClass candidates for import from LDAP, that is, persons by default.
Checking the configuration of an LDAP server
To check the configuration of an LDAP server:
1. Access LDAP server management.
2. In the edit area, select the LDAP server and click LDAP Check.
Importing persons from an LDAP server
The import of persons from an LDAP directory enables initialization of attributes (of the person or login created in HOPEX) corresponding to parameters with values stored in the LDAP directory.
Example: the "E-mail address" MetaAttribute of the person is initialized with the "mail" LDAP parameter of the person in the LDAP file (if mapping has been carried out).
To import persons from an LDAP directory:
1. Access the User Management pages.
2. In Persons, click Import From LDAP.
3. The LDAP Import Wizard appears.
4. In the LDAP Server field, click the drop-down menu and select the server from which you want to import persons.
5. In the Queried Element field, enter the queried character string.
Example: Support service.
6. Names resulting from the query are listed.
7. Select the persons you want to import.
8. Click OK.
Associating a HOPEX user group with an LDAP user group
An LDAP group defines a group or organization in the LDAP directory or Active Directory. It contains a list of users that can potentially connect to the application.
If a default person group is defined (example "Guests") and no LDAP group is specified, a person authenticated in LDAP (with the
Belongs to a person group option selected, see
"Person Properties") automatically belongs to the group defined by default (example: "Guests").
To specify a user group authenticated with the LDAP directory:
1. Access the LDAP server management pages.
2. Select the LDAP server you want to configure and click
Properties 
.
3. In the LDAP server properties pages, select LDAP Groups.
4. Click
Connect 
to connect the existing LDAP user group.
The LDAP Group query wizard appears.
5. (Optional) In the query field, enter the character string to be queried.
6. Click
Find 
.
To execute an advanced query, click
Open Query Tool 
.
Query results are displayed.
7. Select the LDAP user group and click Connect.
Use the [Ctrl] key to select several LDAP user groups at the same time.
The LDAP user group appears in the list.
8. Connect the HOPEX user group to the LDAP user group.
Authentication and a user created on the fly
When a user has been created on the fly, the LDAP parameters can be used as indexing identifier (
Index on Person attribute, see
"Configuring an LDAP parameter") to check that a person with an attribute with the same value as the LDAP directory already exists in
HOPEX.
Example of use:
Anne, responsible for sending questionnaires, wants to send a questionnaire. If one of the addressees does not exist:
• Anne can create the person (example: "Thomas KOCH" with e-mail "tkoch@mega.com")
• Anne cannot create the login of Thomas Koch since she is not an administrator.
When Thomas KOCH connects to HOPEX (Web Front-End), with tkh:
1. The authentication service authenticates tkh with the LDAP directory: the "mail" parameter exists and is indexing identifier type (Index on Person is selected),
2. The authentication service checks if a person already has this e-mail.
Answer: Yes.
3. The authentication service creates the login associated with the person.
If Thomas KOCH has assignments to complete the questionnaire, he can connect to the application to complete this questionnaire.
