#### LDAP

This module enables authentication using LDAP bind, a Directory Server operation which associates a user ID password with a particular LDAP entry. You can define multiple LDAP authentication configurations for a realm. The LDAP authentication attributes are realm attributes. The attributes are:

- Primary LDAP Server

- Secondary LDAP Server

- DN to Start User Search

- DN for Root User Bind

- Password for Root User Bind

- Password for Root User Bind (confirm)

- Attribute Used to Retrieve User Profile

- Attributes Used to Search for a User to be Authenticated

- User Search Filter

- Search Scope

- Enable SSL to Access LDAP Server

- Return User DN to Authenticate

- LDAP Server Check Interval

- User Creation Attribute List

- Authentication Level

##### Primary LDAP Server

Specifies the host name and port number of the primary LDAP server specified during OpenSSO installation. This is the first server contacted for authentication. The format is``hostname:port``. If there is no port number, assume `389`.

If you have OpenSSO deployed with multiple domains, you can specify the communication link between specific instances of OpenSSO and Directory Server in the following format (multiple entries must be prefixed by the local server name):

`local_servername|server:port local_servername2|server2:port2 ...`

For example, if you have two OpenSSO instances deployed in different locations (L1-machine1-IS and L2- machine2-IS) communicating with different instances of Directory Server (L1-machine1-DS and L2-machine2-DS), it would look the following:

`L1-machine1-IS.example.com|L1-machine1-DS.example.com:389`

`L2-machine2-IS.example.com|L2-machine2-DS.example.com:389`

##### Secondary LDAP Server

Specifies the host name and port number of a secondary LDAP server available to the OpenSSO platform. If the primary LDAP server does not respond to a request for authentication, this server would then be contacted. If the primary server is up, OpenSSO will switch back to the primary server. The format is also ``hostname:port``. Multiple entries must be prefixed by the local server name.

Caution – When authenticating users from a Directory Server that is remote from the OpenSSO, it is important that both the Primary and Secondary LDAP Server Ports have values. The value for one Directory Server location can be used for both fields.

##### DN to Start User Search

Specifies the DN of the node where the search for a user would start. (For performance reasons, this DN should be as specific as possible.) The default value is the root of the directory tree. Any valid DN will be recognized. If OBJECT is selected in the Search Scope attribute, the DN should specify one level above the level in which the profile exists. Multiple entries must be prefixed by the local server name. The format is ``servername|search dn``.

For multiple entries:

``servername1|search dn servername2|search dn servername3|search dn`...`

If multiple entries exist under the root organization with the same user ID, then this parameter should be set so that the only one entry can be searched for or found in order to be authenticated. For example, in the case where the agent ID and user ID is same under root org, this parameter should be `ou=Agents` for the root organization to authenticate using Agent ID and `ou=People,` for the root organization to authenticate using User ID.

##### DN for Root User Bind

Specifies the DN of the user that will be used to bind to the Directory Server specified in the Primary LDAP Server and Port field as administrator. The authentication service needs to bind as this DN in order to search for a matching user DN based on the user login ID. The default is `amldapuser.` Any valid DN will be recognized.

##### Password for Root User Bind

Carries the password for the administrator profile specified in the DN for Root User Bind field. There is no default value. Only the administrator's valid LDAP password will be recognized.

##### Password for Root User Bind (confirm)

Confirm the password.

##### Attribute Used to Retrieve User Profile

Specifies the attribute used for the naming convention of user entries. By default, OpenSSO assumes that user entries are identified by the uid attribute. If your Directory Server uses a different attribute (such as givenname) specify the attribute name in this field.

##### Attributes Used to Search for a User to be Authenticated

Lists the attributes to be used to form the search filter for a user that is to be authenticated, and allows the user to authenticate with more than one attribute in the user's entry. For example, if this field is set to uid, employeenumber , and mail, the user could authenticate with any of these names. These attributes must be set separately.

##### User Search Filter

Specifies an attribute to be used to find the user under the DN to Start User Search field. It works with the User Naming Attribute. There is no default value. Any valid user entry attribute will be recognized.

##### Search Scope

Indicates the number of levels in the Directory Server that will be searched for a matching user profile. The search begins from the node specified in the DN to Start User Search attribute. The default value is SUBTREE. One of the following choices can be selected from the list:

OBJECT

  Searches only the specified node.

ONELEVEL

  Searches at the level of the specified node and one level down.

SUBTREE

  Search all entries at and below the specified node.

##### Enable SSL to Access LDAP Server

Enables SSL access to the Directory Server specified in the Primary and Secondary LDAP Server and Port field. By default, the box is not checked and the SSL protocol will not be used to access the Directory Server.

If the LDAP Server is running with SSL enabled (LDAPS), you must make sure that OpenSSO is configured with proper SSL trusted certificates so that AM could connect to Directory server over LDAPS protocol

##### Return User DN to Authenticate

When the OpenSSO directory is the same as the directory configured for LDAP, this option may be enabled. If enabled, this option allows the LDAP authentication module to return the DN instead of the User ID, and no search is necessary. Normally, an authentication module returns only the User ID, and the authentication service searches for the user in the local OpenSSO LDAP. If an external LDAP directory is used, this option is typically not enabled.

##### LDAP Server Check Interval

This attribute is used for LDAP Server failback. It defines the number of minutes in which a thread will “sleep” before verifying that the LDAP primary server is running.

##### User Creation Attribute List

This attribute is used by the LDAP authentication module when the LDAP server is configured as an external LDAP server. It contains a mapping of attributes between a local and an external Directory Server. This attribute has the following format:

attr1|externalattr1

attr2|externalattr2

When this attribute is populated, the values of the external attributes are read from the external Directory Server and are set for the internal Directory Server attributes. The values of the external attributes are set in the internal attributes only when the `User Profile`attribute (in the Core Authentication module) is set to Dynamically Created and the user does not exist in local Directory Server instance. The newly created user will contain the values for internal attributes, as specified in User Creation Attributes List, with the external attribute values to which they map.

##### Authentication Level

The authentication level is set separately for each method of authentication. The value indicates how much to trust an authentication mechanism. Once a user has authenticated, this value is stored in the SSO token for the session. When the SSO token is presented to an application the user wants to access, the application uses the stored value to determine whether the level is sufficient to grant the user access. If the authentication level stored in an SSO token does not meet the minimum value required, the application can prompt the user to authenticate again through a service with a higher authentication level. The default value is 0.

Note – If no authentication level is specified, the SSO token stores the value specified in the Core Authentication attribute Default Authentication Level.