AD/LDAP Connections

You can integrate your applications with your AD/LDAP server with a few keystrokes. All you need is your AD/LDAP server's connection properties.

The flow is simple, when an AD/LDAP user authenticates successfully, the same user will be created in PlusAuth to make sure your LDAP users and your application benefits from all of PlusAuth functionality and features. However, every time they try to log in, the password verification will be handled by your AD/LDAP server.

To create an AD/LDAP connection, go to Dashboard > Connections > Enterprise Connections > AD/LDAP .

AD/LDAP federated connection contains two sections for the configuration which are Connection Configuration and User Object Mapping.

Connection Configuration

Like any external connection, PlusAuth must know your AD/LDAP server's connection details and credentials to interact with it.

User Object Mapping

Companies have different structures and user profiles in their AD/LDAP servers. To ensure consistency with your application and different connection types, PlusAuth requires you to map PlusAuth user's properties with your AD/LDAP user's attributes.

The mapping configuration is written in JSON format. The configuration's keys correspond to fields in the PlusAuth user object, and some LDAP specific configuration, such as:

• email
• username
• blocked
• object_classes etc.

Value Types

Each key expects a value of one of the following types:

• string
• boolean
• string[] (array of strings)
• a constant value object

These values represent the attribute name in the AD/LDAP user object.

{
  "phone_number": true
}

{
  "username": "uid"
}

{
  "name": [
    "name",
    "cn"
  ]
}

{
  "metadata.my_attr": { "value": "MY_CONSTANT_VALUE" }
}

get-aduser ##Username## -Properties *

Required Fields in Mapping Configuration

You don't need to map all the fields but some are required. Required ones are:

Other fields are optional but in some cases they may be crucial to set, otherwise some flows will not work as expected or some AD/LDAP users would lack some functionality. For example, if you are using SMS Multi-Factor Authentication in your application, as you would guess, a phone number is required. If your AD/LDAP users already have a phone number you should map its attribute too.

// array of objects
{
    day: string
    hour: number
    allowed: boolean
}[]

Password Caching

PlusAuth supports caching AD/LDAP users' passwords in its database. This ensures availability even when your AD/LDAP instance is not reachable.

To enable this feature, set the password property to true in your AD/LDAP connection's mappings.

Example:

{
  "id": "objectGUID",
  "password": true,
  //... (other mappings)
}

After setting the mapping, whenever an AD/LDAP user authenticates successfully, their password will be stored in the user credentials.

Importing AD/LDAP Users to PlusAuth

By default, PlusAuth will create a user entry to its internal database whenever an AD/LDAP user signs in successfully. If you need to import all AD/LDAP connection's users you can use AD/LDAP synchronization. Go to your connection details and switch to Synchronize tab.

To synchronize users PlusAuth needs an LDAP filter to fetch users. Default LDAP filter is (objectClass=person) which is too broad and may import unwanted entries, such as system or service accounts. To avoid this, you should provide a more specific filter.

Here’s an example that:

• Ensures only user accounts (not computers, groups, etc.) are included
• Excludes disabled accounts
• Filters out common Exchange-related system mailboxes

(
  &(objectCategory=person)
  (objectClass=user)
  (!(userAccountControl:1.2.840.113556.1.4.803:=2))
  (!(name=SystemMailbox*))
  (!(name=HealthMailbox*))
  (!(name=DiscoverySearchMailbox*))
)

Once you've saved your custom LDAP filter, click the Synchronize button to begin importing AD/LDAP users into PlusAuth.

Note that, the synchronization process may take some time depending on the size of your AD/LDAP directory.