nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

URGENT - WSMP LDAP Integration

Aryan

Hi All,

How does the WSMP LDAP integration work?

1. Is it as simple as importing users in to the Master Realm and synchronising it regularly?

or 2. Creating an LDAP conenction and Authenticating from it directly?

Please repond. Its really urgent!!!

Find more posts tagged with

Comments

jman

This should be easy and OOTB function.

Please refer to the product manual - WSMP Admin Ref Guide, under the Library Manager/Trustees Node/LDAP Links Node section.

To answer your question, yes, you need to setup a LDAP link to import the user from AD to WSMP Library as trustee, regular re-sync is required and a command line tool is available. Please note that password will not be imported/re-sync as it's not allowed in the LDAP protocol.

John

jman

If you need to authenticate directly with AD (but in this case you still need to import your user from AD to WSMP), you can use the Trusted Logon feature in WSMP, which leverage IIS to authenticate with AD.

John

shirinp

Have you tried trustedlogon method using C# in .net? I'm having difficulty in figuring out what to pass as the parameters. I have reviewed the trustedlogonprocedure.pdf, but everything uses JAAS

Also, does anyone know what TrustedAuthenticateSimpleSession is used for under the SessionManagerFactory? When I try to use this, it doesn't even throw an exception... rather it just errors out completely.

jman

Trusted Logon to IIS is OOTB. But I don't have any experience on programming JAAS.

castelli

As a follow-up to this thread: has anyone built an LDAP connector to allow authentication with Windows AD? Yes, I know that this is built-in to WSMP as the TrustedLogon feature, but our network group will not allow us to have our externally facing web-server on the domain. Thus, (according to IWOV support) we can't utilize the Trusted Logon feature.

So, as an alternative, we were thinking of having our WSMP server use LDAP to authenticate users against our AD domain. However, in another call with IWOV support, I found that there is really no "generic" LDAP connector. You have to build each one using JAAS (how could this not be OOTB functionality?). We have no Java guys in-house. Only .NET.

So, if anyone has bothered to set something like this up, your input and advice would be greatly appreciated.

jman

For the external facing web server, I assume you mean it's on the DMZ, actually you can still use TrustedLogon but user will have to enter their domain user name and password explicitly. However, this is assume that the web server in DMZ can integrate with your AD, which requires a number of ports to be open in the firewall....

John

castelli

John,

Thanks for the response. Yes, our webserver is in the DMZ. However, Interwoven Support told us specifically that we could not validate against our AD domain unless we wrote a custom LDAP connector using JAAS. If you know that this is possible, can you provide the specifics (e.g. server settings) so we can test it out?

When we were in our test environment we did have our server on the domain. So, clicking the TrustedLogon checkbox on the logon screen was all a user had to do to be authenticated. However, if the user typed in their username and password (and domain) it only validated against the local application server's records. In other words, the users' couldn't type in their domain password, only the password that was stored on the WSMP server. This further led me to believe that there was no LDAP functionality.

Anyway, if you do have specifics on how to get this working I would much appreciate it.

Thanks,

Scott

For the external facing web server, I assume you mean it's on the DMZ, actually you can still use TrustedLogon but user will have to enter their domain user name and password explicitly. However, this is assume that the web server in DMZ can integrate with your AD, which requires a number of ports to be open in the firewall....

John

jman

Scott,

As far as I know, TrustedLogon works as its name implies. For IIS, when IIS has authenticated the user, then WSMP web app will trust IIS and let the user in without asking for user name and password again.

So in your case, if you can still configure your IIS to authenticate user with your AD, then TrustLogon should still works. But from the end user perspective, since they are accessing the IIS from internet, IIS will first pop-up the authentication window when user access the WSMP URL, user has to put in his account/password in AD in order to proceed, then the WSMP logon page will show, and user will have to check the "TrustedLogon" check box and click OK.

But usually the problem is that quite a number of ports has to be opened in the firewall between the DMZ and intranet in order to integrate your IIS (in DMZ) with the AD server (which should be in the intranet). And this has nothing to do with WSMP.

In fact, I haven't try to implement this as the network administrator do not allow to open so many ports in order to integrate the IIS in DMZ with the AD in intranet. But if you manage to do this, TrustedLogon should still work.

John

Migrateduser

There is an LDAP authentication module in OOTB WSMP Web Components. It is not documented as it is not tested by QA. But a few customers use it in production though. If you are ready to perform your own testing, you can probably use it. Again, it is provided as-is, with no warranty from IWOV.

If you are interested in trying this out, please contact tech support again and point them to this thread.