Configuring LDAP authentication
LDAP authentication is available only if you have HOPEX Power Supervisor technical module.An LDAP directory enables storage of user data of the enterprise.
HOPEX Administration allows you to create users authenticated at LDAP server level.
Only users (example: Administrator) with HOPEX Administrator or User Management Administrator profile can enter LDAP data, see The Administration profiles provided.Configuring LDAP authentication
To configure LDAP authentication:
1. Create an LDAP server in HOPEX Administration.
2. Specify parameters of your LDAP server.
3. (Optional) You can:
• configure LDAP parameters
• modify LDAP import parameters
Once LDAP authentication is configured:
• you can import persons from the LDAP directory.
• or you can manually map a HOPEX user group with a user group declared in your LDAP server.
When connecting to HOPEX, the authentication service uses the HOPEX Login and password of the user to authenticate the user with the list of available LDAP servers.Accessing LDAP server management
To access LDAP server management:
From HOPEX Administration, in the User Management folder, right-click Authentication and select Manage LDAP Servers.The Manage LDAP Servers window opens.
Creating an LDAP server
The LDAP server is the server on which the LDAP directory is installed.
The LDAP directory can be an Active Directory directory.
To create an LDAP server:
1. Access LDAP server management.
2. In the Manage LDAP server window menu bar, click New 
.
.3. In the creation of LDAP server dialog box, enter the Name of the LDAP server and click OK.
The new LDAP server appears in the list of LDAP servers.
You must configure the LDAP server, see Configuring the LDAP server.
Configuring the LDAP server
LDAP server configuration is restricted to users with HOPEX Administrator or User Management Administrator profile.To configure an LDAP server:
Prerequisite: the LDAP server is already created.
1. Access LDAP server management.
2. Select the new LDAP server and click Properties 
.
.3. In the Characteristics tab, complete the following fields:
• LDAP Server Name: name of the server hosting the LDAP directory.
• LDAP Port: LDAP communication bridge
Example: 389
• LDAP Root Address: root address of th LDAP server. This is an important attribute to limit query for a user in the LDAP directory or to address a particular forest.
• LDAP Identifier: this is the LDAP attribute enabling unique identification of a user
Example: SAMAccountName, UID
• LDAP SSL Encryption: select Yes if you want LDAP directory connection to be SSL protocol encoded
• LDAP Anonymous Connection : if you select No, you must specify the user via which LDAP directory connection will be made, as well as the user password
Only an administrator user can connect anonymously to an LDAP server.• LDAP User: enter the identifier of the LDAP user used for LDAP directory connection. If connection is anonymous, this field should not be completed.
This user must have reading rights on data that HOPEX needs to access (example: LDAP person group, membership of a group in LDAP, e-mail in LDAP, etc.).• Authentication Password: enter the password of the LDAP user used for LDAP directory connection. If connection is anonymous, this field should not be completed.
• (If needed) Select Synchronize with LDAP directory to synchronize LDAP parameters defined on the LDAP server (HOPEX) with the updates of the LDAP directory parameters.
4. Click OK.
The LDAP server is configured.
You can also:
• configure an LDAP parameter, see Configuring an LDAP parameter.
• modify content of LDAP directory import, see Modifying LDAP directory import content.
Configuring an LDAP parameter
An LDAP parameter is an authentication parameter that exists in the LDAP directory and that is associated uniquely with a HOPEX attribute.
Configuring an LDAP parameter is useful when importing persons from an LDAP directory. This configuration enables initialization of attributes (of the person or login created in HOPEX) corresponding to parameters with values stored in the LDAP directory.
Example: the "E-mail address" MetaAttribute of the person is initialized with the "mail" LDAP parameter of the person in the "Active Directory" LDAP directory (if mapping has been carried out).
To configure an LDAP parameter:
1. Access LDAP server management.
2. Select the LDAP server for which you want to configure an LDAP parameter and click Properties 
.
.3. In the LDAP Parameters tab, click New .
.The LDAP parameter enables pre-completion of characteristics of a person corresponding to the LDAP parameters.4. Enter the Name of the LDAP parameter (example: Mail), then click Properties 
.
.5. (Optional, "expert" metamodel access) Select Index on Persons, so that the parameter value enables unique identification of a person. If a person in HOPEX has the same e-mail as a person defined in the LDAP directory, this person is reused (instead of creating a new person and risking duplicating the same person).
6. (Optional, "expert" metamodel access) Select Is available for search so that an e-mail can be entered in the import entry area.
Example: if you enter ctodd@mega.com, you should find Clara TODD.
7. In the MetaAttribute field, click the arrow and select Connect MetaAttribute.
8. Execute a query on the MetaAttribute (example: E-mail).
When importing persons from the LDAP directory, the LDAP parameter (example: mail) will initialize the MetaAttribute (example: E-mail address).
Modifying LDAP directory import content
You can modify LDAP directory import content:
• export candidate objects:
This option enables definition of the type of objects to be imported from the LDAP directory.
Default value: person.
• the list of objects browsed for LDAP query
This option enables addition to the import of a particular person and/or persons of a team ("organization").
Default value: organization,organizationalUnit,person
To define content of LDAP directory import:
1. Access the environment options management window.
2. In the options tree, expand the Installation folder and select User Management.
3. (Optional) In the right pane, modify the List of ObjectClass candidates for import from LDAP option.
To import objects other than persons (default value), for example resources or org-units, specify this in this field. Objects should be separated by commas.
Everything that is imported creates occurrences of persons with login.
4. (Optional) In the right pane, modify the List of ObjectClass browsed for LDAP query option.
To add a person or organization to the import, enter the name of the person or organization (example: Quality) in the field.
The result is the list of ObjectClass candidates for import from LDAP, that is, persons by default.
Importing persons from an LDAP server
The import of persons from an LDAP directory enables initialization of attributes (of the person or login created in HOPEX) corresponding to parameters with values stored in the LDAP directory.
Example: the "E-mail address" MetaAttribute of the person is initialized with the "mail" LDAP parameter of the person in the LDAP file (if mapping has been carried out).
To import persons from an LDAP directory:
1. Open the user management window.
2. In the Persons tab, click Import From LDAP.
3. The LDAP Import Wizard appears.
4. In the LDAP Server field, click the drop-down menu and select the server from which you want to import persons.
The LDAP server must be created, seeCreating an LDAP server.5. In the Queried Element field, enter the queried character string.
Example: Support service.
6. Names resulting from the query are listed.
7. Select the persons you want to import.
8. Click OK.
Authentication and a user created on the fly (Web Front-End)
Creation of a user on the fly is not available for connection to HOPEX (Windows Front-End).When a user has been created on the fly, the LDAP parameters can be used as indexing identifier (Index on Person attribute, see Configuring an LDAP parameter) to check that a person with an attribute with the same value as the LDAP directory already exists in HOPEX.
Example of use:
Anne, responsible for sending questionnaires, wants to send a questionnaire. If one of the addressees does not exist:
• Anne can create the person (example: "Thomas KOCH" with e-mail "tkoch@mega.com")
• Anne cannot create the login of Thomas Koch since she is not an administrator.
When Thomas KOCH connects to HOPEX (Web Front-End), with tkh:
1. The authentication service authenticates tkh with the LDAP directory: the "mail" parameter exists and is indexing identifier type (Index on Person is selected),
2. The authentication service checks if a person already has this e-mail.
Answer: Yes.3. The authentication service creates the login associated with the person.
If Thomas KOCH has assignments to complete the questionnaire, he can connect to the application to complete this questionnaire.