Connecting an LDAP System

You can configure Cadenza for two-step authentication via an LDAP system (e.g. Microsoft Active Directory). Communication between the LDAP server and Cadenza is possible via LDAP as well as via LDAPS.

Two-Step Authentication

With two-step authentication, the first step is to search for the user name entered in the login dialog using the access data of a technical user. In the second step, the actual authentication is carried out using the user’s returned DN and the password entered in the login dialog. If several objects with the attribute value searched for are found, the login is attempted for the next object until a login is successful.

Configuration and Requirements

Requirements:

  • The feature LDAP connection (AUTHENTICATOR_LDAP) must be available and active

  • Configure the feature using the accessmanagerldap Configuration

  • The LDAP system must be entered as the authenticator LDAP in the accessmanager config

Additionally, if the LDAP system is to be used as a group mapper (see Configuration of Authentication, Group Assignment and Transfer of Properties):

  • The LDAP system must be entered in the accessmanager Configuration as the group mapper LDAP

  • Rules must be configured for the assignment of logged-in users to Cadenza user groups (see the settings rule and dynamic-group-rule)

Additionally, if the LDAP system is to be used as a property mapper (Information on property mappers):

  • The LDAP system must be entered in the accessmanager Configuration as property mapper LDAP

  • User variables must be defined via which certain properties of the user can be transferred from their attributes in the LDAP system to Cadenza (see the settings attribute, user-mail-attribute and user-real-name-attribute).