Configuring LDAP Sync

The LDAP Sync configuration is stored in the xml files LDAPSync.xml, defaults.xml and optional configuration files for specific client settings.

Note:LDAP Sync must be installed beforehand. For more information, see Installing LDAP Sync.

This page includes the following:

LDAPSync.xml

LDAPSync.xml contains the following three elements:

  • Connection

    LDAP connection configuration.

    Type: Complex

    Mandatory:Yes

  • AE

    AE connection configuration

    Type: Complex

    Mandatory: Yes

  • Clients

    Configure the path to the mapping configurations and the default settings for each client.

    See also: Configuring LDAP Sync Client Settings

    Type: Complex

    Mandatory: Yes

Connection Element Attributes

LDAP-specific settings required for connectivity.

  • serverName

    Name of the LDAP server:

    Type: String

    Default: -

    Mandatory: Yes

    Example: MyCompany AD02

  • directoryType

    Values: AD or other

    Type: Option

    Default: AD

    Mandatory: No

  • url

    The IP address of the LDAP server or its fully qualified domain name and communication port on which the LDAP server listens:

    Note: To specify multiple servers, separate the url entries with a comma. The first server where a connection can be established will be used.

    Example: ad01.mycompany.com:389,ad02.mycompany.com:389

    Type: String

    Default: -

    Mandatory: Yes

  • useSSL

    Important! You need to configure a TLS/SSL certificate before using this setting.

    To use TLS/SSL, the certificate(s) of the LDAP server must be available to the LDAP Sync Process. LDAP Sync uses the default keystore file cacerts in the lib/security directory of the JRE.

    If you want to use an individual keystore file, you must start the LDAP Sync tool using -Djavax.net.ssl.trustStore=path_to_keystore and -Djavax.net.ssl.trustStorePassword=keystorepass.

    Example

    java -Djavax.net.ssl.trustStore=path_to_keystore -Djavax.net.ssl.trustStorePassword=keystorepass jar ldap-sync.jar -cl 100

    You can enable TLS/SSL for the LDAP connection as follows:

    • true: enabled
    • false: disabled

    Type: Boolean

    Default: False

    Mandatory: No

  • connectionTimeout

    The time to wait for an LDAP connection to open (in seconds).

    Note: If you do not want to set a timeout, set it to 0 (zero).

    Type: Number

    Default: 0

    Mandatory: No

  • retryConnect

    Number of times that LDAP Sync tries to reconnect to the LDAP server if the connection is shut down.

    Type: String

    Default: 0

    Tip: Set this value to 10 in your default configuration file. However, if this file is not used or this value is not defined, the default value is always 0.

    Mandatory: No

  • username

    The user credentials for an LDAP account with read access to the LDAP directory levels from which you want to import users

    Examples:

    • cn=administrator,cn=users,dc=ad,dc=example,dc=com
    • cn=user,dc=domain,dc=name
    • user@domain.name

    Type: String

    Default: -

    Mandatory: No

  • password

    The password for the user specified in username.

    Notes:

    • You enter or modify the password as plain text. It will be encrypted during the next synchronization run and stored in the configuration file as encrypted password.
    • Special characters must be escaped in order to comply with the xml standard.

    Type: String

    Default: -

    Mandatory: No

  • readTimeout

    The time to wait for a response from the LDAP service (in seconds).

    Note: If you do not want to set a timeout, set it to 0 (zero).

    Type: Number

    Default: 120

    Mandatory: No

  • searchTimeout

    The time to wait for a search result from the LDAP service (in seconds).

    Note: If you do not want to set a timeout, set it to 0 (zero).

    Type: Number

    Default: 60

    Mandatory: No

Example:

<Connection serverName="MyCompany AD02"
            directoryType="AD"
            url="mycompanyad02:389"
            useSSL="false"
            connectionTimeout="0"
            readTimeout="120"
            searchTimeout="60"
            username="mydomain\myuser"
            password="mypassword" 
/>

AE Element Attributes

Configure the connectivity to the Client 0 of the AE.

Important! The AE configuration is required for the synchronization for all clients of the AE.

  • cp

    The address of the Java communication process (JCP) in the AE

    Allowed formats:

    • DNS Name:Port number
      Example: AEserver:8443
    • TCP/IP Address:Port number
      Example: 192.168.0.1:8443

    Type: String

    Mandatory: Yes

  • username

    Username and department of the AE user which is used to update/create the user objects in the clients.

    Important! The user must exist in client 0. The user also requires permissions to create and update all users of all clients.

    Example: 0/AUTOMIC/AUTOMIC

    Type: String

    Mandatory: Yes

  • password

    Password for the AE user specified in the username.

    Note: You enter or modify the password as plain text. It will be encrypted during the next synchronization run and stored in the configuration file as encrypted password.

    Type: String

    Mandatory: Yes

  • trustedCertFolder

    Here you define the location of the folder for trusted certificates used for TLS/SSL connections. For more information, see Securing Connections to the AE (TLS/SSL).

    Example: "C:\CD\..\Automation.Platform\Agents\certificates"

Example:

<AE cp="192.168.0.1:2217"
    username="0/AUTOMIC/AUTOMIC"
    password="automic"
    trustedCertFolder="path/to/cer/folder"/>

Clients Element Attributes

You must specify where the default settings for all clients are located and from which folder the client settings are taken.

  • path

    The absolute or relative path to the folder containing the default configuration file and optional individual client configuration files.

    Default: clients folder related to the main configuration folder.

    Type: String

    Mandatory: Yes

  • default

    The name of the default configuration file which is used to set default values for all configured clients.

    Note: You can overwrite the default configuration with specific client settings for a specific client number. See also: Configuring LDAP Sync Client Settings.

    Type: String

    Mandatory: No

    Default: defaults.xml

Example:

<Clients
    path="clients" 
    default="defaults.xml"
/>