diff --git a/en/docs/administer/managing-users-and-roles/managing-user-stores/configure-primary-user-store/configuring-a-read-only-ldap-user-store.md b/en/docs/administer/managing-users-and-roles/managing-user-stores/configure-primary-user-store/configuring-a-read-only-ldap-user-store.md index 178d941c07..4c03766034 100644 --- a/en/docs/administer/managing-users-and-roles/managing-user-stores/configure-primary-user-store/configuring-a-read-only-ldap-user-store.md +++ b/en/docs/administer/managing-users-and-roles/managing-user-stores/configure-primary-user-store/configuring-a-read-only-ldap-user-store.md @@ -1,133 +1,460 @@ # Configuring a Read-Only LDAP User Store -Follow the given steps to configure a read-only LDAP/AD as the primary user store: +It is assumed that you have already setup your read-only LDAP user store. Follow the given steps to configure it as the primary user store in WSO2 API Manager: - [Step 1: Setting up the read-only LDAP/AD user store manager](#step-1-setting-up-the-read-only-ldapad-user-store-manager) - [Step 2: Updating the system administrator](#step-2-updating-the-system-administrator) - [Step 3: Starting the server](#step-3-starting-the-server) -### Step 1: Setting up the read-only LDAP/AD user store manager - !!! info - API Manager is compatible with multiple user stores. Instead of using the embedded user store, you can set your own user store as the primary user store. -Before you begin - -- Navigate to `/repository/conf` directory to open `deployment.toml` file and do user_store_properties configurations according to the LDAP user store provider. Following is the sample read-only user store configurations: - ``` - [user_store.properties] - TenantManager="org.wso2.carbon.user.core.tenant.CommonHybridLDAPTenantManager" - ConnectionURL="ldap://localhost:10390" - ConnectionName="uid=admin,ou=system" - ConnectionPassword="admin" - AnonymousBind="false" - UserNameAttribute="uid" - UserNameSearchFilter="(&(objectClass=person)(uid=?))" - ReadGroups="true" - GroupSearchBase="ou=system,CN=Users,DC=wso2,DC=test" - GroupNameAttribute="cn" - GroupNameSearchFilter="(&(objectClass=groupOfNames)(cn=?))" - GroupNameListFilter="(objectClass=groupOfNames)" - MembershipAttribute="member" - BackLinksEnabled="false" - UsernameJavaRegEx="[a-zA-Z0-9._\\-|//]{3,30}$" - PasswordJavaRegEx="^[\\S]{5,30}$" - SCIMEnabled="true" - PasswordHashMethod="PLAIN_TEXT" - MultiAttributeSeparator="," - MaxUserNameListLength="100" - MaxRoleNameListLength="100" - UserRolesCacheEnabled="true" - LDAPConnectionTimeout=5000 - ReplaceEscapeCharactersAtUserLogin="true" - ConnectionRetryDelay="120000" - GroupSearchFilter="(objectClass=groupOfNames)" - UserEntryObjectClass="identityPerson" - IsBulkImportSupported="true" - defaultRealmName="WSO2.ORG" - EmptyRolesAllowed="true" - UserSearchBase="ou=Users,dc=wso2,dc=org" - ConnectionPoolingEnabled="false" - StartTLSEnabled="false" - WriteGroups="true" - RolenameJavaRegEx="[a-zA-Z0-9._\\-|//]{3,30}$" - GroupEntryObjectClass="groupOfNames" - EnableMaxUserLimitForSCIM="false" - PasswordJavaRegExViolationErrorMsg="Password length should be within 5 to 30 characters" - PasswordJavaScriptRegEx="^[\\S]{5,30}$" - UsernameJavaRegExViolationErrorMsg="Username pattern policy violated" - UserNameListFilter="(objectClass=person)" - UsernameJavaScriptRegEx="^[\\S]{3,30}$" - kdcEnabled="false" - ``` - -- The `class` attribute for a read-only LDAP/Active Directory is `org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager`. - ``` - [user_store] - class="org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager" - type = "read_only_ldap" - ``` - -!!! note - Note that these configurations will automatically applied to the `user-mgt.xml` file so you do not need to edit it. - -Given below is a sample for the LDAP/AD user store configuration in read-only mode. You can change the values to match your LDAP/AD in `deployment.toml` file. For descriptions on each of the properties used in the `/repository/conf/deployment.toml` file which are used for configuring the primary user store , see [Properties of User Stores](#ConfiguringaRead-OnlyLDAPUserStore-Properties used in Read-only LDAP user store manager). -The configuration for the external read-only user store in the user-mgt.xml file looks as follows for the above configurations: - - - - - true - 100 - WSO2.ORG - , - true - admin - false - true - org.wso2.carbon.user.core.tenant.CommonHybridLDAPTenantManager - ou=Users,dc=wso2,dc=org - (&(objectClass=groupOfNames)(cn=?)) - false - false - true - (&(objectClass=person)(uid=?)) - 5000 - uid - cn - [a-zA-Z0-9._\-|//]{3,30}$ - true - false - uid=admin,ou=system - ldap://localhost:10390 - ^[\S]{3,30}$ - (objectClass=groupOfNames) - [a-zA-Z0-9._\-|//]{3,30}$ - groupOfNames - ^[\S]{5,30}$ - false - PLAIN_TEXT - ou=system,CN=Users,DC=wso2,DC=test - true - true - 120000 - member - identityPerson - Password length should be within 5 to 30 characters - 100 - ^[\S]{5,30}$ - false - Username pattern policy violated - true - (objectClass=groupOfNames) - true - SHA-256 - (objectClass=person) - ^[\S]{3,30}$ - false - false - - -   + API Manager is compatible with multiple user stores. Instead of using the embedded user store, you can set your own user store as the primary user store. + +## Step 1: Setting up the read-only LDAP/AD user store manager + +The following are the minimum configurations that are required to configure the Read-only LDAP userstore manager. + + + + + + + + + + + + + + + + + + + +
Configuration NameDisplay NameDescription
typeuserstore TypeThis indicates the type of userstore manager that we are using. For Read-only LDAP userstore manager, this value +should be read_only_ldap_unique_id. +
base_dnUser Search BaseThis is the DN of the context or object under which the user entries are stored in the userstore. When the userstore searches for users, it will start from this location of the directory.
+Sample values: ou=Users,dc=wso2,dc=org
+ +Following are the minimum userstore properties that are required to configure the Read-only LDAP userstore manager. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Property IdPrimary userstore PropertySecondary userstore PropertyDescription
ConnectionURLconnection_urlConnection URL

This is the connection URL to the user store server.

+

Sample values:
+ldap://10.100.1.100:389
+ldaps://10.100.1.102:639
+
+If you are connecting over ldaps (secured LDAP).
+you need to import the certificate of the userstore to <​APIM_HOME>/repository/resources/security/client-truststore.jks. For information on how to add certificates to the truststore and how keystores are configured and used in a system, see
+Using asymmetric encryption
+
+If LDAP connection pooling is used, see enable connection pooling for LDAPS connections.
+

ConnectionNameconnection_nameConnection Name

This is the username used to connect to the userstore and perform various operations. This user does not need to be an administrator in the userstore or have an administrator role in the WSO2 product that you are using, but this user must have permissions to read the user list and users' attributes and to perform search operations on the userstore. The value you specify is used as the DN (Distinguish Name) attribute of the user who has sufficient permissions to perform operations on users and roles in LDAP.

+

This property is mandatory.
+Sample values: uid=admin,ou=system

ConnectionPasswordconnection_passwordConnection PasswordPassword for the ConnectionName user
+ +Replace the default `user_store` configuration in the `/repository/conf/deployment.toml +` file, as per your ldap server configuration. A sample configuration is given below. + +``` toml +[user_store] +type = "read_only_ldap_unique_id" +base_dn = "ou=system" +connection_url = "ldap://localhost:10389" +connection_name = "uid=admin,ou=system" +connection_password = "admin" +``` +Apart from the properties mentioned above, WSO2 API Manager also supports advanced LDAP configurations. + +--- + +### Properties used in read-only LDAP userstore manager + +Any of the following properties can be configured for the `PRIMARY` userstore by adding them as follows to +`/repository/conf/deployment.toml`. + +``` toml +[user_store] + = +``` +For example : + +``` toml +[user_store] +read_groups = true +``` + +!!! tip + The properties given below can also be configured for a secondary userstore through the management console. + +### Properties used in read-only LDAP userstore manager + +Any of the following properties can be configured for the `PRIMARY` userstore by adding them as follows to +`/repository/conf/deployment.toml`. + +``` toml +[user_store] + = +``` +For example : + +``` toml +[user_store] +read_groups = true +``` + +!!! tip + The properties given below can also be configured for a secondary userstore through the management console. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Property IdPrimary Userstore PropertySecondary Userstore Property +Description
UserEntryObjectClassuser_entry_object_classUser Entry Object ClassThe object class that is used to construct user entries
+

Default: identityPerson (a custom object class defined in WSO2 Identity Server)

UserNameAttributeuser_name_attributeUsername Attribute

This is a uniquely identifying attribute that represents the username of the user. Users can be authenticated using their email address, UID, etc. The value of the attribute is considered as the username.

+

Default: uid
+
+ Note: email address is considered as a special case in WSO2 products, if you want to set the email address as username, see Using email address as the username

UserIDAttributeuser_id_attributeUser ID Attribute

This is the attribute used for uniquely identifying a user entry. The value of the attribute is considered as the unique user ID.

+

Default: scimId

UserNameSearchFilteruser_name_search_filterUser Search FilterFiltering criteria used to search for a particular user entry
+

Default : (&amp;(objectClass=person)(uid=?))

UserNameListFilteruser_name_list_filterUser List FilterThis is the filtering criteria for searching user entries in the userstore. This query or filter is used when doing search operations on users with different search attributes.
+
+

Default: (objectClass=person)


+In this case, the search operation only provides the objects created from the person object class.
UserDNPatternuser_dn_patternUser DN Pattern

This is the pattern for the user's DN, which can be defined to improve the search. When there are many user entries in the LDAP userstore, defining a UserDNPattern provides more impact on performances as the LDAP does not have to travel through the entire tree to find users.

+

Sample values: uid={0},ou=Users,dc=wso2,dc=org

DisplayNameAttributedisplay_name_attributeDisplay name attributeThis is an optional property. The Display Name Attribute is the name by which users will be listed when you list users in the management console. +

Default: blank

ReadGroupsread_groupsRead GroupsWhen WriteGroups is set to false, none of the groups in the userstore can be read, and the following group configurations are NOT mandatory: GroupSearchBase, GroupNameListFilter, or GroupNameAttribute.
+

Default: true +
+Possible values:
+true: Reads groups from userstore
+false: Doesn’t read groups from userstore

WriteGroupswrite_groupsWrite GroupsIndicates whether groups should be write to the userstore
+

Default: true +
+Possible values:
+true: Writes groups to userstore
+false: Does not write groups to userstore, so only internal roles can be created. Whether the existing userstore groups will be read, depends on the value of the ReadGroups property.
+

UserSearchBaseuser_search_baseUser Search BaseDN of the context or object under which the users are stored in the user store. When the user store searches for users, it will start from this location of the directory +

Default: ou=Users,dc=wso2,dc=org

GroupSearchBasegroup_search_baseGroup Search Base

This is the DN of the context or object under which the group entries are stored in the userstore. When the userstore searches for groups, it will start from this location of the directory.

+

Default: ou=Groups,dc=wso2,dc=org

GroupEntryObjectClassgroup_entry_object_classGroup Entry Object ClassObject class used to construct group entries.
+Default: groupOfNames
GroupNameAttributegroup_name_attributeGroup Name AttributeThis is the attribute used for uniquely identifying a group entry. This attribute is to be treated as the group name. +

Default: cn

GroupNameSearchFiltergroup_name_search_filterGroup Search Filter

Filtering criteria used to search for a particular group entry

+

Default: (&amp;(objectClass=groupOfNames)(cn=?))

GroupNameListFiltergroup_name_list_filterGroup List Filter

This is the filtering criteria for searching group entries in the userstore. This query or filter is used when doing search operations on groups with different search attributes.

+

Default: ((objectClass=groupOfNames)) In this case, the search operation only provides the objects created from the +groupOfName object class.

RoleDNPatternrole_dn_patternRole DN Pattern

This denotes the pattern for the group's DN which can be defined to improve the search. When there are many group entries in the LDAP userstore, defining a RoleDNPattern provides more impact on performances as the LDAP does not have to traverse through the entire tree to find the group.

+

Sample values: cn={0},ou=Groups,dc=wso2,dc=org

MembershipAttributemembership_attribute_rangeMembership Attribute

Defines the attribute that contains the distinguished names (DN) of user objects that are in a group

+

Default: member

MemberOfAttributemember_of_attributeMember Of AttributeDefines the attribute that contains the distinguished names (DN) of group objects that a user is assigned to
+Possible values: memberOf
BackLinksEnabledback_links_enabledEnable Back LinksThis defines whether the backlink support is enabled. If you are using MemberOfAttribute attribute, this should be set to true. +

Default : false

UsernameJavaRegExusername_java_regexUsername RegEx (Java)This is the regular expression used by the back-end components for username validation. By default, strings with non-empty characters have a length of 3 to 30 allowed. You can provide ranges of alphabets, numbers, and ASCII values in the RegEx properties.
+

Default: [a-zA-Z0-9._\-|//]{3,30}$

UsernameJava
ScriptRegEx		username_java
_script_regex		Username RegEx (Javascript)The regular expression used by the front-end components for username validation
+

Default: ^[\S]{3,30}$

UsernameJavaReg
ExViolationErrorMsg		username_java_reg
_ex_violation_error_msg		Username RegEx Violation Error MessageError message when the Username does not match with UsernameJavaRegEx
+

Default: Username pattern policy violated

PasswordJavaRegExpassword_java_regexPassword RegEx (Java)The regular expression used by the back-end components for password validation. By default, strings with non-empty characters have a length of 5 to 30 allowed. You can provide ranges of alphabets, numbers, and ASCII values in the RegEx properties.
+

Default: ^[\S]{5,30}$

PasswordJava
ScriptRegEx		password_java
_script_regex		Password RegEx (Javascript)The regular expression used by the front-end components for password validation
+

Default: ^[\S]{5,30}$

PasswordJavaReg
ExViolationErrorMsg		password_java_reg
ex_violation_error_msg		Password RegEx Violation Error MessageError message when the Password is not matched with passwordJavaRegEx
+

Default: Password length should be within 5 to 30 characters

RolenameJavaRegExrolename_java_regexRole Name RegEx (Java)The regular expression used by the back-end components for role name validation. By default, strings with non-empty characters have a length of 3 to 30 allowed. You can provide ranges of alphabets, numbers and also ranges of ASCII values in the RegEx properties.
+

Default: [a-zA-Z0-9._\-|//]{3,30}$

SCIMEnabledscim_enabledEnable SCIMThis is to configure whether user store is supported for SCIM provisioning.
+
+Possible values:
+True : User store support for SCIM provisioning.
+False: User does not store support for SCIM provisioning. +
+Default: true
PasswordHashMethodpassword_hash_methodPassword Hashing Algorithm

Specifies the Password Hashing Algorithm used the hash the password before storing in the userstore
+Possible values:
+SHA - Uses SHA digest method. SHA-1, SHA-256
+MD5 - Uses MD 5 digest method.
+PLAIN_TEXT - Plain text passwords.(Default)

+

If you configure this as SHA, it is considered as SHA-1. It is always better to configure algorithm with a higher bit value as the digest bit size would be increased.
+
+Most of the LDAP servers (such as OpenLdap, OpenDJ, AD, ApacheDS and etc.) are supported to store passwords as salted hashed values (SSHA).
+Therefore, WSO2 API Manager just wants to feed passwords into the connected userstore as a plain text value. Then LDAP userstore can store them as a salted hashed value. To feed the plain text into the LDAP server, you need to set PasswordHashMethod to “PLAIN_TEXT”
+However, if your LDAP does not support storing user passwords as hashed values, you can configure the WSO2 API Manager to hash the password and then feed the hashed password into the LDAP server. For this, you need to configure the PasswordHashMethod property with SHA (SHA-1), SHA-256, or SHA-512. The WSO2 API Manager cannot create a salted hashed password (SSHA) to feed into the LDAP.

MultiAttribute
Separator		multi_attribute
_separator		Multiple Attribute SeparatorThis property is used to define a character to separate multiple attributes. This ensures that it will not appear as part of a claim value. Normally “,” is used to separate multiple attributes, but you can define ",,," or "..." or a similar character sequence.
+

Default: “,”

MaxUserName
ListLength 		max_user_name
_list_length		Maximum User List LengthThis controls the number of users listed in the userstore of WSO2 API Manager. This is useful when you have a large number of users and don't want to list them all. Setting this property to 0 displays all users.
+

Default: 100


+In some userstores, there are policies to limit the number of records that can be returned from the query. Setting the value to 0 will list the maximum results returned by the userstore. If you need to increase this, you need to set it in the userstore level.
+Eg : Active directory has the MaxPageSize property with the default value as 1000.
MaxRoleName
ListLength		max_role_name_
list_length		Maximum Role List Length

This controls the number of roles listed in the userstore of WSO2 API Manager. This is useful when you have a large number of roles and don't want to list them all. Setting this property to 0 displays all roles.
+

Default: 100


+In some userstores, there are policies to limit the number of records that can be returned from the query. Setting the value to 0 will list the maximum results returned by the userstore. If you need to increase this, you need to set it in the userstore level.

+

Eg: Active directory has the MaxPageSize property with the default value as 1000.

kdcEnabledkdc_enabledEnable KDCIf your userstore is capable of acting as a Kerberos Key Distribution Center (KDC) and if you prefer to enable it, set this property to true.
+

Default: false

UserRoles
CacheEnabled		user_roles_
cache_enabled		Enable User Role CacheThis is to indicate whether to cache the role list of a user.
+Default: true
+
+Possible values:
+false: Set it to false if the user roles are changed by external means and those changes should be instantly reflected in the Carbon instance. +
+Default: true
Connection
PoolingEnabled		connection_
pooling_enabled		Enable LDAP Connection PoolingDefines whether LDAP connection pooling is enabled
+Possible values:
+True: Enables connection pooling. Enabling it will improve the performance.
+False: Disables connection pooling +
+

Default: false


LDAPConnectionTimeoutldap_connection_timeoutLDAP Connection TimeoutTimeout in making the initial LDAP connection. This is configured in milliseconds.
Default: 5000
ReadTimeoutread_timeoutLDAP Read TimeoutThe value of this property is the read timeout in milliseconds for LDAP operations. If the LDAP provider cannot get an LDAP response within that period, it aborts the read attempt. The integer should be greater than zero. An integer less than or equal to zero indicates that no read timeout is specified, which is equivalent to waiting for the response infinitely until it is received. +
+

Default: not configured

Membership
AttributeRange		membership_
attribute_range		Membership Attribute Range

This is to define the maximum users of role returned by the LDAP/AD userstore. This does not depend on the max page size of the userstore.

+

Default: not configured

RetryAttemptsretry_attemptsRetry AttemptsRetry the authentication request if a timeout happens +

Default: not configured

+ +--- + +Following are some key points to consider : 1. Update the connection details to match your user store. For example: @@ -220,20 +547,67 @@ The configuration for the external read-only user store in the user-mgt.xml file 7. In WSO2 products based on Carbon 4.5.x, you can set the `LDAPConnectionTimeout` property: If the connection to the LDAP is inactive for the length of time (in milliseconds) specified by this property, the connection will be terminated. -### Step 2: Updating the system administrator +Following is a sample of read-only LDAP related user_store_properties in `/repository/conf/deployment.toml` file: +``` +[user_store.properties] +ConnectionURL="ldap://localhost:10390" +ConnectionName="uid=admin,ou=system" +ConnectionPassword="admin" +AnonymousBind="false" +UserNameAttribute="uid" +UserNameSearchFilter="(&(objectClass=person)(uid=?))" +ReadGroups="true" +GroupSearchBase="ou=system,CN=Users,DC=wso2,DC=test" +GroupNameAttribute="cn" +GroupNameSearchFilter="(&(objectClass=groupOfNames)(cn=?))" +GroupNameListFilter="(objectClass=groupOfNames)" +MembershipAttribute="member" +BackLinksEnabled="false" +UsernameJavaRegEx="[a-zA-Z0-9._\\-|//]{3,30}$" +PasswordJavaRegEx="^[\\S]{5,30}$" +SCIMEnabled="true" +PasswordHashMethod="PLAIN_TEXT" +MultiAttributeSeparator="," +MaxUserNameListLength="100" +MaxRoleNameListLength="100" +UserRolesCacheEnabled="true" +LDAPConnectionTimeout=5000 +ReplaceEscapeCharactersAtUserLogin="true" +ConnectionRetryDelay="120000" +GroupSearchFilter="(objectClass=groupOfNames)" +UserEntryObjectClass="identityPerson" +IsBulkImportSupported="true" +defaultRealmName="WSO2.ORG" +EmptyRolesAllowed="true" +UserSearchBase="ou=Users,dc=wso2,dc=org" +ConnectionPoolingEnabled="false" +StartTLSEnabled="false" +WriteGroups="true" +RolenameJavaRegEx="[a-zA-Z0-9._\\-|//]{3,30}$" +GroupEntryObjectClass="groupOfNames" +EnableMaxUserLimitForSCIM="false" +PasswordJavaRegExViolationErrorMsg="Password length should be within 5 to 30 characters" +PasswordJavaScriptRegEx="^[\\S]{5,30}$" +UsernameJavaRegExViolationErrorMsg="Username pattern policy violated" +UserNameListFilter="(objectClass=person)" +UsernameJavaScriptRegEx="^[\\S]{3,30}$" +kdcEnabled="false" +``` -The **admin** user is the super tenant that will be able to manage all other users, roles and permissions in the system by using the management console of the product. Therefore, the user that should have admin permissions is required to be stored in the user store when you start the system for the first time. By default, the system will create an admin user in the LDAP that has admin permissions. But this cannot be done it the LDAP user store is read-only. Hence that capability should be disabled as follows: +## Step 2: Updating the system administrator + +The **admin** user is the super tenant that will be able to manage all other users, roles and permissions in the system by using the management console of the product. Therefore, the user that should have admin permissions is required to be stored in the user store when you start the system for the first time. By default, the system will create an admin user in the LDAP that has admin permissions. But this cannot be done it the LDAP user store is read-only. Hence that capability should be disabled in the `/repository/conf/deployment.toml` file as follows: ``` [super_admin] -username = "admin" +username = "AdminSOA" admin_role = "admin" create_admin_account = false ``` - **create_admin_account:** This should be set to 'False' as it will not be allowed to create users and roles in a read-only user store. - **admin_role:** The admin role you enter here should already exist in the read-only user store. Otherwise, you must enter an internal role, which will be saved to the internal database of the system when the system starts the first time. -- **username:** Since we are configuring a read-only LDAP as the primary user store, the user that should have admin permissions is required to be stored in the user store when you start the system for the first time. For example, say a valid username is AdminSOA. Update the `admin_role` section of your configuration as shown above. You do not have to update the password element as it is already set in the user store. +- **username:** Since we are configuring a read-only LDAP as the primary user store, the user that should have admin permissions is required to be stored in the user store when you start the system for the first time. For example, say a valid username is AdminSOA. Update the `username` section of your configuration as shown above. You do not have to update the password element as it is already set in the user store. If the user store can be written to, you can add the super tenant user to the user store. Therefore, create_admin_account should be set to true as shown below. @@ -243,403 +617,12 @@ username = "admin" admin_role = "admin" create_admin_account = true ``` -For information information about the system administrator user, see [Configuring the System Administrator]({{base_path}}/reference/config-catalog/#super-admin-configurations) , and for information on how keystores are used in WSO2 products, see [Using Asymmetric Encryption]({{base_path}}/install-and-setup/setup/security/configuring-keystores/keystore-basics/creating-new-keystores/) . +For information about the system administrator user, see [Configuring the System Administrator]({{base_path}}/reference/config-catalog/#super-admin-configurations) , and for information on how keystores are used in WSO2 products, see [Using Asymmetric Encryption]({{base_path}}/install-and-setup/setup/security/configuring-keystores/keystore-basics/creating-new-keystores/) . -### Step 3: Starting the server +## Step 3: Starting the server Start your server and try to log in as the admin user you specified. The password is the admin user's password in the LDAP server. -### [Properties used in Read-only LDAP user store manager](#ConfiguringaRead-OnlyLDAPUserStore-Properties used in Read-only LDAP user store manager) - -The following are the minimum configurations that are needed to be provided to configure the Read-only LDAP user store manager. - - - - - - - - - - - - - - - - - - -
Configuration NameDisplay NameDescription
typeUser Store TypeType of the user store manager that we are using. For Read-only LDAP user store manager this value -should be read_only_ldap. -
base_dnUser Search BaseDN of the context or object under which the user entries are stored in the user store. When the user store searches for users, it will start from this location of the directory
-Sample values: ou=Users,dc=wso2,dc=org
- - -Following are the minimum user store properties that are needed to be provided to configure Read-only LDAP user store manager. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Property IdPrimary User Store PropertySecondary User Store PropertyDescription
ConnectionURLconnection_urlConnection URLConnection URL to the user store server. In the case of default LDAP in Carbon, the port is specified in the carbon.xml file, and a reference to that port is included in this configuration. -

Sample values:

-

ldap://10.100.1.100:389

-

ldaps://10.100.1.102:639

-
-If you are connecting over ldaps (secured LDAP)
-Need to import the certificate of user store to the client-truststore.jks of the WSO2 product. For information on how to add certificates to the truststore and how keystores are configured and used in a system, see Using Asymmetric Encryption.
-Using asymmetric encryption
-
-If LDAP connection pooling is used, see enable connection pooling for LDAPS connections.
-

ConnectionNameconnection_nameConnection NameThe username used to connect to the user store and perform various operations. This user does not need to be an administrator in the user store or have an administrator role in the WSO2 product that you are using, but this user MUST have permissions to read the user list and users' attributes and to perform search operations on the user store. The value you specify is used as the DN (Distinguish Name) attribute of the user who has sufficient permissions to perform operations on users and roles in LDAP

-

This property is mandatory.
-Sample values: uid=admin,ou=system

ConnectionPasswordconnection_passwordConnection PasswordPassword for the ConnectionName user.
- -Any of the following properties can be configured for the `PRIMARY` user store by adding them as follows to `/repository/conf/deployment.toml`. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Property IdPrimary User Store PropertySecondary User Store Property - Description
UserEntryObjectClassuser_entry_object_classUser Entry Object ClassObject class used to construct user entries.
- Default: identityPerson
UserNameAttributeuser_name_attributeUsername AttributeThe attribute used for uniquely identifying a user entry. Users can be authenticated using their email address, UID, etc. The name of the attribute is considered as the username. -

Default: uid
-
- Note: email address is considered as a special case in WSO2 products, if you want to set the email address as username, see Using email address as the username

UserNameSearchFilteruser_name_search_filterUser Search FilterFiltering criteria used to search for a particular user entry.
- Default : (&amp;(objectClass=person)(uid=?))
UserNameListFilteruser_name_list_filterUser List FilterFiltering criteria for searching user entries in the user store. This query or filter is used when doing search operations on users with different search attributes.
-
- Default: (objectClass=person)
- In this case, the search operation only provides the objects created from the person object class.
UserDNPatternuser_dn_patternUser DN PatternThe pattern for the user's DN, which can be defined to improve the search. When there are many user entries in the LDAP user store, defining a UserDNPattern provides more impact on performances as the LDAP does not have to travel through the entire tree to find users. -

Sample values: uid={0},ou=Users,dc=wso2,dc=org

DisplayNameAttributedisplay_name_attributeDisplay name attributeThis is an optional property. The Display Name Attribute is the name by which users will be listed when you list users in the management console. -

Default: blank

ReadGroupsread_groupsRead GroupsWhen WriteGroups is set to false, this Indicates whether groups should be read from the user store. If this is disabled by setting it to false, none of the groups in the user store can be read, and the following group configurations are NOT mandatory: GroupSearchBase, GroupNameListFilter, or GroupNameAttribute.
-

Default: true -
- Possible values:
- true: Read groups from user store
- false: Don’t read groups from user store

WriteGroupswrite_groupsWrite GroupsIndicates whether groups should be write to the user store.
-

Default: true -
- Possible values:
- true: Write groups to user store
- false: Do not write groups to user store, so only internal roles can be created. Depend on the value of ReadGroups property, it will read existing groups from user store or not
-

GroupSearchBasegroup_search_baseGroup Search BaseDN of the context or object under which the group entries are stored in the user store. When the user store searches for groups, it will start from this location of the directory -

Default: ou=Groups,dc=wso2,dc=org

GroupEntryObjectClassgroup_entry_object_classGroup Entry Object ClassObject class used to construct group entries.
- Default: groupOfNames
GroupNameAttributegroup_name_attributeGroup Name AttributeAttribute used for uniquely identifying a group entry. This attribute is to be treated as the group name. -
Default: cn
GroupNameSearchFiltergroup_name_search_filterGroup Search FilterFiltering criteria used to search for a particular group entry. -

Default: (&amp;(objectClass=groupOfNames)(cn=?))

GroupNameListFiltergroup_name_list_filterGroup List FilterFiltering criteria for searching group entries in the user store. This query or filter is used when doing search operations on groups with different search attributes. -

Default: ((objectClass=groupOfNames)) In this case, the search operation only provides the objects created from the - groupOfName object class.

RoleDNPatternrole_dn_patternRole DN PatternThe pattern for the group's DN, which can be defined to improve the search. When there are many group entries in the LDAP user store, defining a RoleDNPattern provides more impact on performances as the LDAP does not have to traverse through the entire tree to find a group. -

Sample values: cn={0},ou=Groups,dc=wso2,dc=org

MembershipAttributemembership_attribute_rangeMembership AttributeDefines the attribute that contains the distinguished names (DN) of user objects that are in a group. -

Default: member

MemberOfAttributemember_of_attributeMember Of AttributeDefine the attribute that contains the distinguished names (DN ) of group objects that user is assigned to.
- Possible values: memberOf
BackLinksEnabledback_links_enabledEnable Back LinksDefines whether the back link support is enabled. If you are using MemberOfAttribute attributes this should be set to 'true'. -
Default : false
UsernameJavaRegExusername_java_regexUsername RegEx (Java)The regular expression used by the back-end components for username validation. By default, strings with non-empty characters have a length of 3 to 30 allowed. You can provide ranges of alphabets, numbers and also ranges of ASCII values in the RegEx properties.
- Default: [a-zA-Z0-9._\-|//]{3,30}$
UsernameJava
ScriptRegEx		username_java
_script_regex		Username RegEx (JavaScript)The regular expression used by the front-end components for username validation.
- Default: ^[\S]{3,30}$
UsernameJavaReg
ExViolationErrorMsg		username_java_reg
_ex_violation_error_msg		Username RegEx Violation Error MessageError message when the Username is not matched with UsernameJavaRegEx
- Default: Username pattern policy violated
PasswordJavaRegExpassword_java_regexPassword RegEx (Java)The regular expression used by the back-end components for password validation. By default, strings with non-empty characters have a length of 5 to 30 allowed. You can provide ranges of alphabets, numbers and also ranges of ASCII values in the RegEx properties.
- Default: ^[\S]{5,30}$
PasswordJava
ScriptRegEx		password_java
_script_regex		Password RegEx (JavaScript)The regular expression used by the front-end components for password validation.
- Default: ^[\S]{5,30}$
PasswordJavaReg
ExViolationErrorMsg		password_java_reg
ex_violation_error_msg		Password RegEx Violation Error MessageError message when the Password is not matched with passwordJavaRegEx
- Default: Password length should be within 5 to 30 characters
RolenameJavaRegExrolename_java_regexRole Name RegEx (Java)The regular expression used by the back-end components for role name validation. By default, strings with non-empty characters have a length of 3 to 30 allowed. You can provide ranges of alphabets, numbers and also ranges of ASCII values in the RegEx properties.
- Default: [a-zA-Z0-9._\-|//]{3,30}$
SCIMEnabledscim_enabledEnable SCIMThis is to configure whether user store is supported for SCIM provisioning.
-
- Possible values:
- True : User store support for SCIM provisioning.
- False: User does not store support for SCIM provisioning. -
- Default: false
PasswordHashMethodpassword_hash_methodPassword Hashing AlgorithmSpecifies the Password Hashing Algorithm used the hash the password before storing in the user store.
- Possible values:
- SHA - Uses SHA digest method. SHA-1, SHA-256
- MD5 - Uses MD 5 digest method.
- PLAIN_TEXT - Plain text passwords.(Default) -

If you just configure as SHA, It is considered as SHA-1, It is always better to configure algorithm with higher bit value as digest bit size would be increased.
-
- Most of the LDAP servers (such as OpenLDAP, OpenDJ, AD, ApacheDS and etc..) are supported to store password as salted hashed values (SSHA)
- Therefore WSO2IS server just wants to feed password into the connected user store as a plain text value. Then LDAP user store can store them as salted hashed value. To feed the plain text into the LDAP server, you need to set PasswordHashMethod to “PLAIN_TEXT”
- But; if your LDAP does not support to store user password as hashed values. You can configure WSO2 server to hash the password and feeds the hashed password into the LDAP server. Then you need to configure PasswordHashMethod property with SHA (SHA-1), SHA-256, SHA-512. Please note WSO2 server cannot create a salted hashed password (SSHA) to feed into the LDAP.

MultiAttribute
Separator		multi_attribute
_separator		Multiple Attribute SeparatorThis property is used to define a character to separate multiple attributes. This ensures that it will not appear as part of a claim value. Normally “,” is used to separate multiple attributes, but you can define ",,," or "..." or a similar character sequence
- Default: “,”
MaxUserName
ListLength 		max_user_name
_list_length		Maximum User List LengthControls the number of users listed in the user store of a WSO2 product. This is useful when you have a large number of users and don't want to list them all. Setting this property to 0 displays all users.
- Default: 100
-
- In some user stores, there are policies to limit the number of records that can be returned from the query. Setting the value 0 it will list the maximum results returned by the user store. If you need to increase that you need to set it in the user store level.
- Eg : Active directory has the MaxPageSize property with the default value 1000.
MaxRoleName
ListLength		max_role_name_
list_length		Maximum Role List LengthControls the number of roles listed in the user store of a WSO2 product. This is useful when you have a large number of roles and don't want to list them all. Setting this property to 0 displays all roles.
- Default: 100
-
- In some user stores, there are policies to limit the number of records that can be returned from the query, Setting the value 0 it will list the maximum results returned by the user store. If you need to increase that you need to set it n the user store level. -

Eg: Active directory has the MaxPageSize property with the default value 1000.

kdcEnabledkdc_enabledEnable KDCIf your user store is capable of acting as a Kerberos, Key Distribution Center (KDC) and if you like to enable it, set this property to true.
- Default: false
UserRoles
CacheEnabled		user_roles_
cache_enabled		Enable User Role CacheThis is to indicate whether to cache the role list of a user.
- Default: true
-
- Possible values:
- false: Set it to false if the user roles are changed by external means and those changes should be instantly reflected in the Carbon instance. -
- Default: true
Connection
PoolingEnabled		connection_
pooling_enabled		Enable LDAP Connection PoolingDefine whether LDAP connection pooling is enabled
- Possible values:
- True: Enable connection pooling. Enabling it will improve the performance
- False: Disable connection pooling -
- Default: false
LDAPConnection
Timeout		ldap_connection
_timeout		LDAP Connection TimeoutTimeout in making the initial LDAP connection. This is configured in milliseconds.
- Default: 5000
ReadTimeoutread_timeoutLDAP Read TimeoutThe value of this property is the read timeout in milliseconds for LDAP operations. If the LDAP provider cannot get a LDAP response within that period, it aborts the read attempt. The integer should be greater than zero. An integer less than or equal to zero means no read timeout is specified which is equivalent to waiting for the response infinitely until it is received. -
- Default: not configured
Membership
AttributeRange		membership_
attribute_range		Membership Attribute RangeThis is to define the maximum users of role returned by the LDAP/AD user store. This does not depend on the max page size of the user store. -

Default: not configured

RetryAttemptsretry_attemptsRetry AttemptsRetry the authentication request if a timeout happened -

Default: not configured

LDAPConnection
Timeout		ldap_connection
_timeout		LDAP Connection TimeoutIf the connection to the LDAP is inactive for the length of time - (in milliseconds) specified by this property, the connection - will be terminated. -

Default: not configured


-

Sample: 20

-
diff --git a/en/docs/administer/managing-users-and-roles/managing-user-stores/configure-primary-user-store/configuring-a-read-write-ldap-user-store.md b/en/docs/administer/managing-users-and-roles/managing-user-stores/configure-primary-user-store/configuring-a-read-write-ldap-user-store.md index 6ba9bb4584..04e2d9a4d9 100644 --- a/en/docs/administer/managing-users-and-roles/managing-user-stores/configure-primary-user-store/configuring-a-read-write-ldap-user-store.md +++ b/en/docs/administer/managing-users-and-roles/managing-user-stores/configure-primary-user-store/configuring-a-read-write-ldap-user-store.md @@ -6,7 +6,7 @@ It is assumed that you have already setup your read-write LDAP user store. Follo - [Step 2: Updating the system administrator](#step-2-updating-the-system-administrator) - [Step 3: Starting the server](#step-3-starting-the-server) -### Step 1: Configure the read-write LDAP user store manager +## Step 1: Configure the read-write LDAP user store manager The following are the minimum configurations that are needed to be provided to configure the read-write LDAP userstore manager. @@ -138,7 +138,7 @@ Default: identityPerson( Is a custom object class defined in WSO2 Identity Serve

A uniquely identifying attribute that represents the username of the user. Users can be authenticated using their email address, UID, etc. The value of the attribute is considered as the username.

Default: uid

-Note: email address is considered as a special case in WSO2 products, if you want to set the email address as username, see Using email address as the username

+ Note: email address is considered as a special case in WSO2 products, if you want to set the email address as username, see Using email address as the username

UserIDAttribute @@ -200,6 +200,13 @@ false: Do not write groups to userstore, so only internal roles can be created. +UserSearchBase +user_search_base +User Search Base +DN of the context or object under which the users are stored in the user store. When the user store searches for users, it will start from this location of the directory +

Default: ou=Users,dc=wso2,dc=org

+ + GroupSearchBase group_search_base Group Search Base @@ -487,7 +494,7 @@ Following are some key points to consider : MembershipOfAttribute = "memberOf"  ``` -### Step 2: Updating the system administrator +## Step 2: Updating the system administrator The **admin** user is the super tenant that will be able to manage all other users, roles, and permissions in the system by using the management console of the product. Therefore, the user that should have admin permissions is required to be stored in the userstore when you start the system for the first time. Since the LDAP userstore can be written to, you have the option of creating a new admin user in the userstore when you start the system for the first time. Alternatively, you can also use a user ID that already exists in the LDAP. For information about the system administrator user, see [Configuring the System Administrator]({{base_path}}/reference/config-catalog/#super-admin-configurations) . @@ -513,6 +520,6 @@ These two alternative configurations can be done as explained below. password = "admin" ``` -### Step 3: Starting the server +## Step 3: Starting the server Start your server and try to log in as the admin user you specified in **Step 2** .