Versions Compared

Old Version 23

changes.mady.by.user Brian Miller

Saved on

compared with

New Version Current

changes.mady.by.user Brian Miller

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Configure silhouette.conf: Fix path in bullet 2

...

Table of Contents
minLevel2
maxLevel2
outlinetrue

Preparation Tasks

  1. Deploy Syndeia Cloud according to Intercax Documentation.

  2. Read as much of https://ldap.com/learn-about-ldap/ as you need to be fluent in LDAP terms and administration.

  3. Assure that the browsers on the user workstations which are going to interact with Syndeia Web Dashboard and with the chosen DS can connect to both the SP and the DS and that there are no SSL certificate denials.

  4. Assure that there are no traffic shapers on the corporate network that alter HTTP Request and HTTP Response Headers - especially those headers involved in LDAP protocols.

  5. Assure that there are no network routers or proxies on the corporate network that alter HTTP URLs or HTTP Headers.

  6. Obtain the Fully-qualified Network Domain (FQDN) scheme, host, and port of the Syndeia Cloud SP.

  7. Obtain the FQDN scheme, host, and port of the chosen LDAP DS.

  8. Test your assumptions about your organization’s LDAP DS with either curl or ldapsearch - Syndeia uses a third-party library for LDAP queries and if external, simple LDAP queries do not work, your configuration of Syndeia based on incorrect assumptions is not going to be successful.

    1. Read https://devconnected.com/how-to-search-ldap-using-ldapsearch-examples/

Configure the Directory Store/Server (DS)

...

  • ssh log into the Syndeia Cloud server with a user that can perform “passwordless sudo” operations. Root access is not necessary if sudo access has been established.

  • cd to /opt/icx/syndeia-cloud-current/confs/web-gateway-<SC_version>-impl/conf

  • copy all of the following into silhouette.conf, adding or replacing any existing ldap. settings.

  • Replace all EXAMPLE values – like MYCOMPANY.MYCOM:LDAPPORT– with the values for your organization.

...

Expand
titlePurpose of each Syndeia Silhouette LDAP setting

Setting

Purpose

Mandatory?

Typical

ldap.hostname

names the server that is providing the LDAP service

YES

ldap.company.com

ldap.port

identifies the port on the LDAP server

YES

389 or 636

ldap.adminUserDN

the LDAP Distinguished Name for the LDAP Administrator

Usually

cn=MYADMIN,ou=MYADMINGROUP,dc=MYCOMPANY,dc=MYCOM

ldap.adminPassword

encrypted value of the LDAP Admin’s password

Usually

MYADMINPASS (like #$%^&*_NOSOUPFORYOU)

ldap.baseDN

base Distinguished Name for the start of user queries

YES

ou=MYUSERS,dc=MYCOMPANY,dc=MYCOM

ldap.userBindAttribute

organization’s choice of LDAP attribute that uniquely identifies each user even without a full DN

NO (defaults to “uid”)

uid or sAMAccountName

ldap.mailAttribute

organization’s choice of LDAP attribute that uniquely identifies each user’s Email address

NO (defaults to “mail”)

mail or userPrincipalName

ldap.startTLS

should Syndeia first attempt to establish an SSL session with the LDAP service before making queries?

NO (defaults to false)

false for LDAP, true for Secure-LDAP

ldap.truststorePath

file location on the Syndeia server for the Java Keystore which holds public certificates that sign the public SSL certificate used by the LDAP server

NO

/opt/icx/syndeia-cloud-current/some/secure/path/to/keystore.jks

ldap.truststorePassword

password for the JKS file at ldap.truststorePath

NO (defaults to “changeit”)

Often it is left as “changes” - but it should be changed when it a proper JKS keystore is being used

ldap.trustStoreType

the type of Keystore. JKS is typical. This depends on what the running JVM has been configured to support.

NO (defaults to “jks”)

“jks” - but only when a ldap.truststorePath is present.

ldap.sslProtocol

the algorithm to use for the TLS Protocol

NO (defaults to client/server negotiation)

TLSv1.2

ldap.sslCipher

the encryption algorithm to use for SSL (with JVM, not OpenSSL, name)

NO (defaults to client/server negotiation)

TLS_RSA_WITH_AES_256_CBC_SHA256

When configuring LDAP Group-limited Access, some of the following must be provided:

ldap.groupSettings.dn

Distinguished Name for where to start looking for LDAP Group instances

NO - YES if intending to limit access to a Group

ou=MYTEAMS,dc=MYCOMPANY,dc=MYCOM

ldap.groupSettings.name

a common name value that indicates the team of Syndeia Users

NO - YES if intending to limit access to a Group

MYSYNDEIAUSERGROUP

ldap.groupSettings.bindAttribute

the LDAP attribute in a group instance that identifies the common name

NO (defaults to “cn”)

cn

Operation

  1. Restart the web-gateway service

    1. sudo systemctl restart sc-web-gateway

  2. Open a modern web browser (Chrome, Edge, Safari) and visit http:SYNDEIA.MYCOMPANY.MYCOM:MYSYNDEIAPORT/login or https:SYNDEIA.MYCOMPANY.MYCOM:MYSECURESYNDEIAPORT/login

  3. In the Login Form dialog, enter the LDAP user credentials for an existing LDAP user that is within the ldap.baseDN tree or within the ldap.groupSettings.name LDAP Group (if group-limited LDAP access was configured)

  4. Choose LDAP from the Account chooser

Panel
panelIconId1f926-200d-2642-fe0f
panelIcon:man_facepalming:
panelIconText🤦‍♂️
bgColor#DEEBFF

If an LDAP user in the proper LDAP scope cannot authenticate into Syndeia, re-confirm with an LDAP search utility that the configuration of Syndeia is correct. Verify this yourself. Usually, either the user is using the wrong user name or wrong password or the LDAP repository has a different tree structure than is assumed.

...