Page Comparison

...

In LDAP authentication, the Syndeia Cloud application (generically referred to here as “Service Provider (SP)”) connects to your organization’s LDAP server (aka “Directory [Store|Server] (DS)”) for authentication. Only the LDAP username is stored on Syndeia Cloud, and authentication is handled by your LDAP server for Syndeia Cloud.

Preparation Tasks

1. Deploy Syndeia Cloud according to Intercax Documentation.

2. Read as much of https://ldap.com/learn-about-ldap/ as you need to be fluent in LDAP terms and administration.

3. Assure that the browsers on the user workstations which are going to interact with Syndeia Web Dashboard and with the chosen DS can connect to both the SP and the DS and that there are no SSL certificate denials.

4. Assure that there are no traffic shapers on the corporate network that alter HTTP Request and HTTP Response Headers - especially those headers involved in LDAP protocols.

5. Assure that there are no network routers or proxies on the corporate network that alter HTTP URLs or HTTP Headers.

6. Obtain the Fully-qualified Network Domain (FQDN) scheme, host, and port of the Syndeia Cloud SP.

7. Obtain the FQDN scheme, host, and port of the chosen LDAP DS.

8. Test your assumptions about your organization’s LDAP DS with either curl or ldapsearch - Syndeia uses a third-party library for LDAP queries and if external, simple LDAP queries do not work, your configuration of Syndeia based on incorrect assumptions is not going to be successful.

   1. Read https://devconnected.com/how-to-search-ldap-using-ldapsearch-examples/

Configure the Directory Store/Server (DS)

• Browse to and authenticate into your organization’s choice of DS’s administration website (or LDAP Directory desktop utility such as Azure AD or Apache Directory Studio)

  • In Syndeia Silhouette, this is the ldap.hostname and ldap.port setting

• Enter the integrations management portion of this administration website

• Find or Create a new LDAP service for the DS’s users

• Browse the DS’s LDAP “tree” to discover all of the following

  • The administrator credentials necessary to bind to the LDAP query URL to search the entire tree for groups and users

    • the DS might grant query rights to anonymous users but often a client user or script has to provide administrator credentials to query the DS (via LDAP) for the existence of other user identities

    • This is the “Bind Distinguished Name” (Bind DN) and its password

      • In Syndeia Silhouette, this is the ldap.adminUserDN and the ldap.adminPassword

  • The topmost node in the LDAP tree where user identities are stored.

    • This is the “Base Distinguished Name” (Base DN)

      • In Syndeia Silhouette, this is the ldap.baseDN

  • The topmost node in the LDAP tree where groups are defined

• If you are setting up an LDAP service for the organization, you will need to configure the LDAP tree before attempting to integrate Syndeia with the LDAP service.

...

• ssh log into the Syndeia Cloud server with a user that can perform “passwordless sudo” operations. Root access is not necessary if sudo access has been established.

• cd to /opt/icx/syndeia-cloud-current/confs/web-gateway-<SC_version>-impl/conf

• copy all of the following into silhouette.conf, adding or replacing any existing ldap. settings.

• Replace all EXAMPLE values – like MYCOMPANY.MYCOM:LDAPPORT– with the values for your organization.

...

Operation

1. Restart the web-gateway service

   1. sudo systemctl restart sc-web-gateway

2. Open a modern web browser (Chrome, Edge, Safari) and visit http:SYNDEIA.MYCOMPANY.MYCOM:MYSYNDEIAPORT/login or https:SYNDEIA.MYCOMPANY.MYCOM:MYSECURESYNDEIAPORT/login

3. In the Login Form dialog, enter the LDAP user credentials for an existing LDAP user that is within the ldap.baseDN tree or within the ldap.groupSettings.name LDAP Group (if group-limited LDAP access was configured)

4. Choose LDAP from the Account chooser

...