Syndeia Cloud offers delegated authentication to industry-standard and commercial LDAP Identity Providers
In LDAP authentication, the Syndeia Cloud application (generically known as the “Service Provider (SP)”) connects to your organization’s LDAP server (aka “Directory [Store] (DS)”) for authentication. Only the LDAP username is stored on Syndeia Cloud, and authentication is handled by your LDAP server for Syndeia Cloud.
...
Deploy Syndeia Cloud according to Intercax Documentation.
Read as much of https://ldap.com/learn-about-ldap/ as you need to be fluent in LDAP terms and administration.
Assure that the browsers on the user workstations which are going to interact with Syndeia Web Dashboard and with the chosen IdP DS can connect to both the SP and the IdP DS and that there are no SSL certificate denials.
Assure that there are no traffic shapers on the corporate network that alter HTTP Request and HTTP Response Headers - especially those headers involved in LDAP protocols.
Assure that there are no network routers or proxies on the corporate network that alter HTTP URLs or that alter HTTP Headers.
Obtain the Fully-qualified Network Domain (FQDN) scheme, host, and port of the Syndeia Cloud SP.
Obtain the FQDN scheme, host, and port of the chosen LDAP IdPDS.
Test your assumptions about your organization’s LDAP IdP DS with either of
curl
orldapsearch
- Syndeia uses a third-party library for LDAP queries and if external, simple LDAP queries do not work, your configuration of Syndeia based on incorrect assumptions is not going to be successful.
Configure the
...
DS
Browse to and authenticate into your organization’s choice of IdP’s DS’s administration web site website (or LDAP Directory desktop utility such as Azure AD or Apache Directory Studio)
In Syndeia Silhouette, this is the
ldap.hostname
andldap.port
setting
Enter the integrations management portion of this administration web sitewebsite
Find or Create a new LDAP service for the IdP’s DS’s users
Browse the IdP’s DS’s LDAP “tree” to discover all of the following
The administrator credentials necessary to bind to the LDAP query URL to search the entire tree for groups and users
the IdP DS might grant query rights to anonymous users but often a client user or script has to provide administrator credentials to query the IdP DS (via LDAP) for the existence of other user identities
This is the “Bind Distinguished Name” (Bind DN) and its password
In Syndeia Silhouette, this is the
ldap.adminUserDN
and theldap.adminPassword
The topmost node in the LDAP tree where user identities are stored.
This is the “Base Distinguished Name” (Base DN)
In Syndeia Silhouette, this is the
ldap.baseDN
The topmost node in the LDAP tree where groups are defined
If you are setting up an LDAP service for the organization, you will need to configure the LDAP tree before attempting to integrate Syndeia with the LDAP service.
...
With LDAP, all management of user identities and of permissible passwords are all the responsibility and choice of the organization.
Assure the LDAP IdP DS has a directory of user identities
Know which users or groups should be permitted access to the Syndeia Service Provider
Users in the organization will not be able to access Syndeia Cloud through LDAP until the organization grants them, through the administration in the LDAP IdPDS, an LDAP user identifier that has a password and an email address.
...
ssh log into the Syndeia Cloud server with a user that can perform “passwordless sudo” operations. Root access is not necessary , if sudo access has been established.
cd to
/opt/icx/syndeia-cloud-current/confs/web-gateway-impl/conf
copy all of the following into
silhouette.conf
, adding or replacing any existingldap.
settings.Replace all EXAMPLE values – like
MYCOMPANY.MYCOM:LDAPPORT
– with the values for your organization.
...
The above illustrates how little configuration is mandatory - if the organization has an a Microsoft AD service.
Expand | |||||
---|---|---|---|---|---|
| |||||
|
...