Guide to Integrating LDAP into Empress for Enhanced Authentication

Developers
1

Introduction

LDAP, or Lightweight Directory Access Protocol, is an industry-standard protocol providing a centralized authentication mechanism, often referred to as Single Sign-On (SSO). Many organizations, from small to large-scale, use an LDAP implementation for efficient and secure user authentication.

By integrating LDAP within Empress, you can leverage your LDAP credentials to log in to your Empress applications. This guide will walk you through the process of setting up and configuring this integration, providing in-depth explanations of each feature and parameter.

Introduction to LDAP Integration in Empress

LDAP Integration in Empress offers a seamless mechanism to authenticate users in a central repository, which can be an invaluable tool for large organizations with diverse roles and access permissions. It simplifies the login process, enhances security, and ensures consistent user access across different services and applications.

This guide will dive into the technical aspects of this feature, exploring how developers can leverage it to enhance user authentication and security in their Empress applications.

1. Configuring LDAP Settings

Let’s start by setting up the LDAP settings within Empress. Navigate to Home > Integrations > LDAP Settings to begin. All mandatory fields are highlighted in bold.

1.1 LDAP Server

Empress is compatible with both OpenLDAP and Active Directory, but any standards-compliant LDAP Directory could serve as the LDAP authentication source.

  • LDAP Directory Server: Choose the option that matches your LDAP Directory: Active Directory for Microsoft Active Directory, OpenLDAP for OpenLDAP, or Custom if you need to adjust the LDAP Group attributes.
  • LDAP Server URL: Enter the URL to your LDAP Server. It must be in the form of ldap://yourserver:port or ldaps://yourserver:port.

1.2 LDAP Authentication

This section involves the user details that will bind to the directory server.

  • Base Distinguished Name (DN): This user will bind to LDAP and needs permission to view the search paths you enter below.
  • Password for Base DN: The password for the user above, used to look up user details on your LDAP server.

1.3 LDAP Search Paths

These paths represent the LDAP Directory objects and must be in LDAP FDN (Full Distinguished Name) format. Ensure that the bind user has read and write access to these paths.

  • LDAP search path for Users: The search path for all users in your LDAP server to log into a Empress app.
  • LDAP search path for Group: The search path for all groups in your LDAP server to log into a Empress app.
  • LDAP Search String: This field allows Empress to match the user/email entered in the Empress login screen, with the LDAP Server, using complex LDAP search filters.

1.4 LDAP User Creation and Mapping

This section maps the LDAP attributes from the directory server to the Empress user.

  • LDAP Email Field: Specifies the LDAP attribute containing the user’s email address.
  • LDAP Username Field: Specifies the LDAP attribute containing the username.
  • LDAP First Name Field: Specifies the LDAP field containing the user’s first name.

1.5 LDAP Security

This optional section configures a secure connection to your directory server.

  • SSL/TLS Mode: Specifies whether to start a TLS session on initial connection to the LDAP server.
  • Require Trusted Certificate: Specifies if you require a trusted certificate to connect to the LDAP server.

1.6 LDAP Custom Directory

This section is mandatory if you select custom directory server and covers the groups that your directory server uses.

1.7 LDAP Group Mapping

This section maps the LDAP Groups to the specified Empress roles.

  • Default Role on Creation: The default role assigned to the user when created in your Empress app.
  • LDAP Group Mappings Table: Allows mapping multiple LDAP groups to Empress roles.

2. Logging into Empress with LDAP

Upon setting up and enabling LDAP, you’ll find the Login Via LDAP option on the login screen. With this, you can use your LDAP credentials to log in to your Empress app.

In conclusion, integrating LDAP into Empress streamlines the user authentication process, enhancing the security and efficiency of your Empress applications. By following this guide, developers can not only implement LDAP integration but also customize it to meet their specific requirements.