LDAP Server

Trivore ID has a built-in LDAP server, letting external services use Trivore ID as their central user account and group repository and single point of authentication over LDAP. The LDAP interface is read-only and only used for authentication purposes — it obeys the same security rules and policies defined elsewhere in Trivore ID, and can't be used to make changes to data.

If your organisation doesn't use LDAP-based authentication, you can skip this page — just make sure the feature stays disabled if it isn't needed.

Enabling LDAP Server platform-wide

LDAP Server must first be enabled by a Portal Admin before it's available to any namespace. Go to System Preferences → Base settings, Core tab, and check LDAP server under Built-in services and features, then Save. This acts as a master switch: unchecking and saving disables the LDAP service immediately, for every namespace.

Even with this enabled, a specific deployment may still show LDAP Server Feature administratively disabled wherever LDAP settings appear — this means the feature isn't provisioned for your deployment at all, regardless of this setting or any namespace's own configuration. Contact support if you expect LDAP Server to be available and see this message.

Enabling LDAP Server per namespace

Once enabled platform-wide, a Namespace Admin can enable it for their own namespace: open Namespaces, select the namespace, Configuration → Edit namespace, Features tab, LDAP server panel.

• Enable LDAP server for authentication turns it on for the namespace. It normally takes a while (from a few seconds for namespaces with up to about 100 accounts, to a few minutes for large, complex namespaces) before LDAP authentication is fully available afterward.
• The LDAP root DN is derived from the namespace code and shown directly on this tab — for a namespace with code company, it's o=company,cn=oneportal. User accounts live under ou=users,o=company,cn=oneportal, and groups under ou=groups,o=company,cn=oneportal.
• Scope for LDAP enablement determines which accounts in the namespace have LDAP enabled — by default, all of them, but it can be restricted to accounts that are (directly or indirectly) a member of a selected group. If you restrict it this way, use a descriptive group name, such as LDAP_Auth_Enabled.
• LDAP authentication DN and LDAP authentication password are an automatically-generated technical bind account, which external services use to bind to the LDAP server for authentication and authorisation purposes. This DN is read-only — it can't make any changes to LDAP or to Trivore ID data. Keep its password safe, and rotate it periodically per your organisation's policy.

LDAP extensions

The same Features tab has an LDAP extensions section, with Enable Cisco extensions. This enables Cisco-specific settings in the user account editor for the namespace — most importantly the ciscoGroupPolicy attribute, used to assign a Cisco VPN or network device group policy to a user over LDAP.

Connecting to the LDAP server

Once enabled and active, the LDAP server is available at the deployment's primary service address, on TCP port 389 via StartTLS, and TCP port 636 via TLS. Trivore ID manages the TLS key and certificate itself; if an external load balancer is used, TLS is normally terminated there instead, with traffic directed to port 389.