CloverDX Server: What You Need to Know About LDAP settings

Here is an example object with its attributes:

LDAP search filter

The LDAP search filter is an expression used for search in LDAP tree. You can run such expression in JXplorer by Search->Search dialog. Fill Start Searching From with start node (called base in Server) and fill Text Filter. You can see the usage in the following images.

An example of user search:

An example of groups assigned to user search:

When a search is successful, you should see found nodes in the left tab "Results". Click on it to see the object (select simple or text mode of HTML View).

LDAP authentication workflow in the CloverDX Server

The following steps describe how CloverDX Server and LDAP work together:

1. The user fills the username and password into the login form and submits it; the Server checks the user type: either local (managed by the Server) or LDAP (this is what we'll set up). Assume the user type is LDAP;
2. The Server tries to connect to the configured LDAP server;
3. If the connection is successful, the Server tries to find user by username (see below);
4. If the user is found, the Server tries to list groups assigned to this user
5. The Server tries to match the user's LDAP groups to Server groups; i.e., all groups that are defined in the Server are intersected with user's LDAP groups. All other are ignored. Thus, LDAP groups identify Server user groups which define user's permissions;
6. The user might need to be a member of an allowed group (see security.ldap.allowed_ldap_groups below);
7. The password is checked against LDAP;
8. User is logged in if password is correct and has at least one group assigned.

CloverDX Server LDAP settings

Let's take a look at what you need to do in the Server configuration to enable LDAP authentication. For details on Server settings, please refer to this page in the documentation. It's important to restart your application server after each change of configuration to apply it.

First, locate the clover.xml configuration. For example, on Tomcat server, each setting mentioned below would be written to [tomcat]\conf\Catalina\localhost\clover.xml file. Refer to the documentation to find the file in your installation.

A sample LDAP configuration in clover.xml:

<?xml version="1.0" encoding="UTF-8"?>
<Context path="/clover" crossContext="true">
<Manager pathname=""/>
<Parameter name="security.authentication.allowed_domains" value="clover,LDAP" override="false" />
<Parameter name="security.ldap.url" value="ldap://mail.mycompany.com:389" override="false" />
<Parameter name="security.ldap.user_search.base" value="ou=people,dc=MyCompany,dc=com" override="false" />
<Parameter name="security.ldap.user_search.filter" value="(uid=${username})" override="false" />
...
</Context>

In the XML above, you can see the Parameter tags. The following chapter will describe all LDAP-related parameters you can use in your configuration.

In case you encounter errors in any of the steps below, check your logs. You can read more about the Server logs location here. Interesting files are (for Tomcat):

• [tomcat]\temp\cloverlogs\userAction.log - contains log of user actions and their results (login succeed/failed)
• [tomcat]\temp\cloverlogs\all.log - contains more technical information

Enable LDAP log in (workflow - step 1)

security.authentication.allowed_domains

Enabled authentication methods. Can be either clover or LDAP or both separated by a comma (i.e. clover,LDAP).

Connection to LDAP server (workflow - step 2)

security.ldap.ctx_factory

The class name with namespace containing context provider implementations. Use "com.sun.jndi.ldap.LdapCtxFactory" for start.

security.ldap.timeout

Timeout when accessing your LDAP server. Use "5000" (unit is milliseconds) for start.

security.ldap.records_limit

Limit of records number returned by the server. Use "50" for start.

security.ldap.url

The URL of your server including port; in format ldap://hostname:port. The default port of the LDAP is 389, or 636 for SSL connection. For Microsoft Active Directory specifics, please see paragraph in the "Pitfalls" section. You can check your URL using JXplorer.

security.ldap.userDN
security.ldap.password

If your LDAP server requires authentication, fill in the credentials of the user who will perform the queries. It's recommended that you create a dedicated user with minimal rights sufficient for this purpose. You can test the credentials by logging in via JXplorer to your LDAP server. "userDN" is the abbreviation for User Distinguishable Name.