Versions Compared

Version Old Version 1 New Version 2
Changes made by

MS (Unlicensed)

MS (Unlicensed)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: 4.0.4 - 9715 - Multiple external roles
Div
classtocc
Table of Contents

...

Div
classtinycode

Property

Default Value

Explanation _____________________________________________

abiquo.auth.module

abiquo

Whether Abiquo should authenticate only via Database or it should also authenticate against LDAP/Active Directory. Values: abiquo , ldap

abiquo.ldap.authentication.server.url

 

LDAP/Active Directory server URL

abiquo.ldap.authentication.server.port

389

LDAP/Active Directory port. In LDAP mode this property is required, even if the server is listening at the default LDAP/Active Directory port

abiquo.ldap.authentication.server.protocol

ldap

Protocol to be used when authenticating to a LDAP/Active Directory. Values: ldap , ldaps

abiquo.ldap.authentication.server.baseDN

 

Base Distinguished Name of the LDAP/Active Directory

abiquo.ldap.authentication.custom.userDnPattern

cn={0},CN=Users

Abiquo will perform an additional custom query against the specified schema in the LDAP/Active Directory. This value is required. With the default value, Abiquo does not perform an additional query.

abiquo.ldap.authentication.
attribute.enterprise

organizationname

The attribute in LDAP/Active Directory to look up the Enterprise Name which must be an Enterprise in Abiquo.

abiquo.ldap.authentication.autoUserCreationtrueWhether Abiquo must create a user in Abiquo based on a successful login to LDAP

Notes about the properties:

...

Users created automatically with no email information in LDAP/AD will not receive system notifications. We recommend that you complete the 'email' field in LDAP/AD before first login or modify the Abiquo user details afterwards.

LDAP/AD Roles

After users log a user logs in, they are granted the first matching role. That is, if more than one LDAP/AD group has equivalence with Abiquo roles, the user will be granted the first group name because only one role is permitted in Abiquo. We do not guarantee the order of roles, so we strongly recommend that System Administrators maintain a one-to-one LDAP/AD group to Abiquo role relation for each user. The Role the platform grants them the role that is mapped to their LDAP/AD groups in the platform, first in their tenant or else at a global level. Abiquo allows only one role per user, so we recommend that you map each set of user groups to a single Abiquo role at the enterprise and/or global level. The user's role is synchronized between LDAP/AD and the Abiquo database.

LDAP/AD User Uniqueness

Users that were automatically created are labeled with 'LDAP' in the authType column in the Abiquo database. And the username will be the Distinguished Name (DN) of the user in LDAP/AD. The user is unique because it is a combination of the username and authtype. Toggling between authentication modes is not supported, but it is possible to swap to LDAP mode after installation by changing the appropriate properties. So if you install Abiquo and later decide to change to LDAP mode, users will still be unique.

...