LDAP

The JFrog Platform supports authenticating users against an LDAP server out-of-the-box.

When LDAP authentication is active, the JFrog Platform Unit (JPD) first attempts to authenticate the user against the LDAP server. If LDAP authentication fails, it then tries to authenticate via its internal database.System Architecture

For every LDAP authenticated user, a new user is created in the internal database (provided the user does not already exist), and automatically assigns that user to the default groups.

The configuration parameters for LDAP connection settings are as follows:

The LDAP Groups Add-on allows you to synchronize your LDAP groups with the system and leverage your existing organizational structure for managing group-based permissions.

Unlike many LDAP integrations, LDAP groups use super-fast caching, and has support for both Static, Dynamic and Hierarchical mapping strategies. Powerful management is accomplished with multiple switchable LDAP settings and visual feedback about the up-to-date status of groups and users coming from LDAP.

LDAP groups synchronization works by instructing the system about the external groups authenticated users belong to. Once logged-in, you are automatically associated with your LDAP groups and inherit group-based permission managed in the system.

Usage

WebUI Changes implemented in Artifactory 7.38.x and above

Security is now called Authentication Providers. All the relevant text and images on this page have been updated to reflect this change.

LDAP Groups settings are available in the Administration module under Authentication Providers | LDAP.

To use LDAP groups you must first set up an LDAP server for authentication from the LDAP Settings screen. You must also alert the system about the correct LDAP group settings to use with your existing LDAP schema.

Active Directory Users

For specific help with setting up LDAP groups for an Active Directory installation please see Active Directory.

Synchronizing LDAP Groups with the JPD

WebUI Changes implemented in Artifactory 7.38.x and above

Security is now called Authentication Providers. All the relevant text and images on this page have been updated to reflect this change.

Importing Groups Through the UI

Once you have configured how groups should be retrieved from your LDAP server, you can verify your set up by clicking the Refresh button on the Synchronize LDAP Groups sub-panel. A list of available LDAP groups is displayed according to your settings.

You are now ready to synchronize/import groups into the system. The groups table allows you to select which groups to import and displays the sync-state for each group:

A group can either be completely new or already existing in JPD. If a group already exists in the system it can become outdated (for example, if the group DN has changed) - this is indicated in the table so you can select to re-import it.

Once a group is imported (synced) a new external LDAP group is created in the system with the name of the group.

Once you have imported LDAP groups, you can Manage Permissions on them as with regular the JPD groups. Users association to these groups is external and controlled strictly by LDAP.

Note

Make sure that LDAP group settings is enabled (in the LDAP Groups Settings panel) in order for your settings to become effective.

To synchronize a group through the UI, in the Administration module, under Authentication Providers | LDAP, select the group you want to synchronize, and search for groups that have been defined under the corresponding group settings. Once groups have been found, select Import.

Once the groups are synchronized, you should see them in your list of groups (Administration module under Authentication Providers | Groups) indicated as External.

Using the REST API

You may also synchronize LDAP groups by using the Create or Replace Group to create groups with the ‘ldap’ realm and full DN path to the group object under your LDAP server.Create or Replace Group

Limitation

Make sure to use lower case only when creating LDAP groups through the REST API.Using upper or mixed case will prevent synchronization of groups.

When using the REST API to synchronize LDAP groups, you need to specify the exact and full Group DN path to the group on your LDAP server. The example below shows the JSON payload you would use to synchronize the "testgroup" group displayed in the below LDAP server:

Sample JSON:
{
        "name": "testgroup",
        "description" : "This groups already exists in ldap",
        "autoJoin" : false,
        "realm": "ldap",
        "realmAttributes": "ldapGroupName=testgroup;groupsStrategy=STATIC;groupDn=cn=testgroup,ou=support,ou=UserGroups,dc=openstack,dc=org"
}

'artifactory.security.ldap.connect.timeoutMillis' for connect. Default value: 10000ms
'artifactory.security.ldap.socket.timeoutMillis' for readRepy timeout. Default value: 15000ms
'artifactory.security.ldap.referralStrategy' for the referral strategy (value can be either 'follow', 'ignore', 'throw'). Default value: follow

</ldapSettings>    
   <ldapGroupSetttings>
        <name>demo</name>
        <forceAttributeSearch>true</forceAttributeSearch>
</ldapSettings>   

You can configure the system to cache data about authentication against external systems such as LDAP for REST API requests. This means that the first time a user needs to be authenticated, the system will query the external system for the user's permissions, group settings etc. The information received from the external system is cached for a period of time which you can configure in the $JFROG_HOME/artifactory/var/etc/artifactory/artifactory.system.propertiesfile by setting the artifactory.security.authentication.cache.idleTimeSecs property. This means that once a user is authenticated, while the authentication data is cached, Artifactory will use the cached data rather than querying the external system, resulting is faster authentication. The default is set to 300 sec.

Storing your LDAP password in clear text in settings.xml on your disk is a big security threat, since this password is very sensitive and is used in SSO to other resources in the domain.

When using LDAP, we strongly recommend, using the JPD's Encrypted Passwords in your local settings.

In some cases, as an administrator you may want to require users to authenticate themselves through LDAP with their LDAP password.

However, if a user already has an internal account with a password in the system, you can set the system to fallback to use their internal password if LDAP authentication fails.

You can prevent this fallback authentication by ensuring that the Disable Internal Password checkbox in the Edit User dialog is set.

To use LDAPS with a valid certificate from a CA trusted by Java, all you need to do is use a secure LDAP URL in your settings, for example, ldaps://secure_ldap_host:636/dc=sampledomain,dc=com.

If you want to use LDAPS with a non-trusted (self-signed) certificate, follow the steps described in Link text.Communication Between Services