Setting up LDAP settings for LiveCycle Workflow Business Activity Monitor

Transcription

1 Adobe Enterprise & Developer Support Knowledge Article ID: c4715 bc Setting up LDAP settings for LiveCycle Workflow Business Activity Monitor In addition to manually creating users and user permissions, LiveCycle Workflow Business Activity Monitor (BAM) enables you to import user information from supported LDAP providers. You can configure scheduled synchronizations with the LDAP server to automatically update the existing users and roles or perform manual synchronization. When synchronizing with the LDAP server, the properties user base DN, login identification and password, full name, description, and address are cached in the BAM database. When LiveCycle Workflow BAM imports users from the LDAP server, LDAP groups are converted to BAM roles. Users are assigned BAM roles according to the group they belong to in LDAP. For more information, see Limitations in LDAP connectivity and Best practices. LiveCycle Workflow BAM supports the following LDAP providers: SunOne Directory Server 5.2 Microsoft Active Directory 2000 Microsoft Active Directory 2003 Note: LiveCycle Workflow BAM should be able to integrate with any LDAP provider that supports LDAP Version 3 Protocol. However, only the three listed above have been tested and are fully supported. This section describes the following topics: Limitations in LDAP connectivity Best practices Setting up LDAP synchronization Setting up LDAP user mapping Setting up LDAP role mapping Manually synchronizing with the LDAP server Limitations in LDAP connectivity The following limitations apply to LiveCycle Workflow BAM: You can configure a connection to only one LDAP server. LiveCycle Workflow BAM creates roles based on groups that are defined on the LDAP server. When LiveCycle Workflow BAM encounters a group for which a role is not yet created, it creates the role and assigns it a set of zero permissions. You can later modify the permissions as required. For information about specifying the LDAP groups to use as roles, see Configuring LDAP role mapping. If LiveCycle Workflow BAM imports a user and the user does not belong to a group to which a BAM role corresponds, the user is created but remains unassigned to any roles. You cannot change the role that a user is assigned to if the user is imported from the LDAP server. Role assignments for imported users can be accomplished by making changes to the LDAP server. However, you can assign manually-created users to roles that are created based on LDAP groups. Best practices When setting up LDAP in LiveCycle Workflow BAM, it is strongly recommended you adhere to the following best practices: If the connection to the LDAP server is not secure, you should use SSL. For information, see the Installing and Configuring LiveCycle Workflow guide. For authentication, SASL is the recommended method and is well supported by LDAP. For security reasons, the access permissions of the LDAP synchronization user should be limited to querying the LDAP server. For more information about the synchronization user, see Setting up LDAP synchronization.

2 Setting up LDAP settings for LiveCycle Workflow Business Activity Monitor 2 The password for this user is stored in the LiveCycle Workflow BAM metadata using reversible symmetric encryption. Therefore, anyone with access to the metadata could conceivably obtain this password. Configuring LDAP synchronization This section describes the settings for scheduling the automatic synchronization of LiveCycle Workflow BAM with the LDAP server. Synchronization ensures that the user accounts and role definitions that LiveCycle Workflow BAM caches in the database are up to date with the content of the LDAP server. During synchronization, LiveCycle Workflow BAM creates new roles based on new groups that on the LDAP server and removes any roles whose groups have been removed from the LDAP server since the previous synchronization. Note: Role removal occurs even if users that were created manually are assigned to the roles. For a user that was created manually and is assigned to a role that is based on an LDAP group, if the role is removed due to synchronization the user account still exists but is no longer assigned to the role. To configure LDAP synchronization: 1. Log on to the BAM Workbench. 2. Open the Administration Console and click System Settings. 3. Click the LDAP Synchronization tab. 4. Select the LDAP Enabled option, if it is not already selected.

3 Setting up LDAP settings for LiveCycle Workflow Business Activity Monitor 3 5. Configure the following settings: Parameter Initial Context Factory LDAP Server LDAP Port LDAP SSL LDAP Authentication LDAP Principal DN Prefix LDAP Principal DN Suffix LDAP Synchronization User LDAP Synchronization Password Value The JNDI (Java Naming and Directory Interface) through which LiveCycle Workflow BAM connects to the LDAP server. The default is com.sun.jndi.ldap.ldapctxfactory. Note: You will probably not need to change this value. The DNS name or IP address of the LDAP server. The port on which the LDAP server is running. The default port is typically 389. However, if you select the SSL option the typical default port is 636. You should talk to your LDAP administrator to confirm the port that you should specify. Select if the LDAP server is configured to use SSL. Selecting this option may affect the LDAP Port setting. There are three options: Simple. You should select this option for SunOne and Microsoft Active Directory. SASL (Simple Authentication and Security Layer) Compare Encrypted Password cn= Refers to the DN suffix at the end of a distinguished name. SunOne and ActiveDirectory typically use the following values: SunOne: ou=people,dc=your domain,dc=com Active domain.com SunOne:,cn=Directory Manager Active Directory: Administrator@your domain.com Password for LDAP Synchronization User 6. Click Test Connection. Note: This button tests the connection and also tests the user mapping and role mapping configuration. If the connection settings are correct, the message will indicate that the connection was successful. If you have not yet configured LDAP User Mapping and LDAP Role Mapping, the message returns an error. 7. Set the LDAP Synchronization Schedule. Use the Add Schedule, Edit Schedule, and Remove Schedule buttons to create the desired schedule. Note: You should set synchronization for a time when the fewest number of users are likely to be logged on. 8. Click OK or click another tab to configure additional settings. The LDAP synchronization settings are now complete. The next section describes the LDAP user mapping parameters Configuring LDAP user mapping This section describes the user mapping parameters that determine which users will be imported and/or synchronized. The settings vary depending on the LDAP server provider being used.

4 Setting up LDAP settings for LiveCycle Workflow Business Activity Monitor 4 Parameter LDAP User Base DN LDAP User Search Filter LDAP User LoginID LDAP User Full Name LDAP User Description Value Use the format appropriate to the indicated provider: SunOne: OU=people,DC=your domain,dc=com Active Directory: CN=Users,DC=yourdomain,DC=com Use the format appropriate to the indicated provider: SunOne: (&(objectclass=inetorgperson)) Active Directory: (&(objectclass=user)) For example, your LDAP server could have a special group for LiveCycle Workflow BAM users. This filter could then ensure that only users with this group membership are imported. SunOne: cn Active Directory: samaccountname This value will become the user s login identification in LiveCycle Workflow BAM. Enter displayname if you are using either SunOne or Active Directory Enter description if you are using either SunOne or Active Directory.

5 Setting up LDAP settings for LiveCycle Workflow Business Activity Monitor 5 LDAP User Primary LDAP User EncryptedPassword Enter mail if you are using either SunOne or Active Directory. Enter userpassword if you are using either SunOne or Active Directory To configure the name mapping parameters: 1. In the System Settings dialog box, click the LDAP User Mapping tab. 2. Configure the following settings: Note: The sample settings in the above table have been tested and used in successfully LDAP configurations. 3. Click the LDAP Synchronization tab and click Test Connection to see if the users are imported successfully. 4. Click OK or click another tab to configure additional settings. Configuring LDAP role mapping This section describes the role mapping parameters that determine which groups/roles are imported and/or synchronized. The settings you specify depend on the LDAP server provider that you use.

6 Setting up LDAP settings for LiveCycle Workflow Business Activity Monitor 6 Parameter LDAP Role Base DN LDAP Role Search Filter LDAP Role LoginID LDAP Role Full Name LDAP Role Description LDAP Role Member LDAP Role Member is Value Use the format appropriate to the indicated provider: SunOne: OU=Groups,DC=yourdomain,DC=com Active Directory: CN=Users,DC=yourdomain,DC=com SunOne: (&(objectclass=groupofuniquenames)) Active Directory: (&(objectclass=group)) Enter cn if you are using either SunOne or Active Directory. Enter displayname if you are using either SunOne or Active Directory. Enter description if you are using either SunOne or Active Directory. SunOne: uniquemember Active Directory: member Select one of the following options: Distinguished Name, if the users are defined using a format such as cn=jadmin,ou=people,dc=yourdomain,dc=com Login identification, if users are defined using a format such as Administrator@yourdomain.com To configure role mapping parameters: 1. In the System Settings dialog box, click the LDAP Role Mapping tab. 2. Configure the following settings: Note: The sample settings in the above table have been tested and used in successfully LDAP configurations Click the LDAP Synchronization tab and click Test Connection to see if the users are imported successfully. Click OK or click another tab to configure additional settings. Manually synchronizing with the LDAP server You can manually synchronize LiveCycle Workflow BAM with the LDAP server any time. Synchronization requests are queued to prevent concurrent synchronizations. To manually synchronize: Synchronize Now button

7 Setting up LDAP settings for LiveCycle Workflow Business Activity Monitor 7 1. Open the Administration Console and click System Settings. 2. Click the LDAP Synchronization tab. 3. Click the Synchronize Now button. A message indicates that the synchronization is complete. The time required to synchronize depends on your Product Adobe LiveCycle Workflow Published November 14, 2005 Adobe Systems Incorporated 345 Park Avenue, San Jose, CA USA Adobe, the Adobe logo, and Better by Adobe. are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States and/or other countries. All other trademarks are the property of their respective owners. Copyright 2005 Adobe Systems Incorporated. All rights reserved.