LDAP Authentication Prerequisites

The process of configuring TeamConnect for LDAP integration includes the following basic steps:

1. Creating Custom LDAP Authentication Error Pages—(optional) Create custom HTML pages for use with LDAP authentication.
2. Defining LDAP Parameters—Enter information in TeamConnect's LDAP properties file.
3. Installing LDAP Plug-in Files—Upload a TeamConnect LDAP properties file to the TeamConnect Documents area. You can also upload customized authentication error messages.
4. Enabling a Default Authentication Method—Enable the LDAP plug-in from TeamConnect Admin Settings.
5. Overriding Authentication for Individual Users—Allows you to enable LDAP authentication for individual user accounts. This step is only required if you do not select LDAP as the default authentication mechanism in the previous step.

LDAPS Compatibility

This guide is focused on configuring LDAP. By default TeamConnect is not compatible with LDAPS and encrypted ports 636 or 3269 but you can update the configuration file in teamconnect-authentication-xxxx.jar/authenticationConfigurationLDAP.xml to enable it.

You should see entry - <constructor-arg value="ldap://${ldap.host}:${ldap.port}/${ldap.root}" />

You can change it to - <constructor-arg value="ldaps://${ldap.host}:${ldap.port}/${ldap.root}" /> 

The port will be in authenticationDescriptor.properties.

You must install an SSL cert into keystore so that you can connect with LDAPS.

Creating Custom LDAP Authentication Error Pages

You have the option to create customized screens for logging into TeamConnect using LDAP authentication and related error messages. To enable custom error pages, you must do the following:

1. Create custom error pages.
2. Update the LDAP authenticationDescriptor.properties file properties for the new pages.
3. Upload the custom pages to the TeamConnect Documents area folder:

\Top Level\System\Authentication\LDAP\pages

See Installing LDAP Plug-in Files for more information.

Note: If you choose not to create customized error and login pages then you should comment out related lines from the LDAP authenticationConfiguration.properties file

Defining LDAP Parameters

To enable TeamConnect to use your LDAP plug-in, you must provide certain parameters which represent your environment and save them in a properties file. You must modify the authenticationDescriptor.properties file for LDAP authentication and enter the appropriate information in these parameters according to the descriptions in the table below.

Note: To comment out a property, type # at the beginning of the line to comment it out

Installing LDAP Plug-in Files

This section describes:

1. Creation of TeamConnect Documents area folders for LDAP files
2. Uploading LDAP configuration files for TeamConnect
3. Uploading custom LDAP screens

LDAP authentication plug-in installation consists of a configuration file, authenticationDescriptor.properties, that must be uploaded to a specific directory within the Documents area of TeamConnect:

You must edit the authenticationDescriptor.properties file, as described in Defining LDAP Parameters.

To install the LDAP Authentication configuration file

1. In the TeamConnect tab bar, select Documents.
2. Navigate to Top Level, then System.
3. Create a folder named Authentication.
4. In the Authentication folder that you just created, create a sub-folder named LDAP.
5. In the LDAP folder that you just created, create the following sub-folders:
   
   Caution: The folder names must be entered exactly as they appear below.
   • classes
   • pages
6. In the classes folder that you just created, upload this file: authenticationDescriptor.properties
7. The pages folder does not require any file uploads, unless you choose to override the default error message pages. using the page.xxx properties in the configuration file. If so, you would upload your matching custom error message pages to this folder.

The LDAP Authentication plug-in is now installed.

To complete the implementation of LDAP, make sure that you are using the correct default authentication method, as described in Enabling a Default Authentication Method. If LDAP is not your default authentication method, override individual users who need LDAP, as described in Overriding Authentication for Individual Users. If LDAP is your default authentication method, you need to perform overrides only:

• For users who may have previously been overridden with a different authentication method and are now using LDAP. In this case you can set their method to (System Default).
• For users who are not using LDAP.

Also, user TeamConnectAdmin should always use the Standard Authentication method. You can force this behavior by appending /standardLogin to the end of the URL that launches TeamConnect for that user.

LDAP Authentication Sample Files

This section provides sample files described in this guide.

• Sample Custom Log-in Page
• Sample Custom Error Page
• Sample Restore Session Page
• Sample LDAP Configuration File

Sample Custom Log-in Page

Note: You do not need to customize the TeamConnect login page for LDAP Authentication. If you customize the login page, however, you must reference the j_spring_security_check servlet, the user field input value should correspond to the j_username variable, the password field input value should correspond to the j_password variable as shown in the example below.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http:// www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <title>Log In - TeamConnect 3.0</title>
</head>
<body scroll="no">
    <div id="horizon" style="margin-top:150px">
        <div id="content">
            <div id="contentText">
                <center>
                <table class="logincontent" border="0" width="600" cellpadding="0" cellspacing="0">
                <tr>
                <td style="background-image: url(images/bg_login.jpg); background- repeat: no-repeat;">
                <!-- LOGIN TABLE [BEGIN] -->
                    <table border="0" width="600" cellpadding="0" cellspacing="0">
                    <tr>
                        <td colspan="2" style="line-height: 1.5em;" align="center"></td>
                    </tr>
                    <tr>
                        <td height="150" align="center">
                            <form method="post" id="loginForm" name="loginForm" action="j_spring_security_check">
                            <table border="0" cellpadding="5" cellspacing="0" style="margin: 10px;">
                            <tr valign="middle">
                                <td width="90" align="right" nowrap><b>User Name:</b></td>
                                <td align="left"><input type="text" name="j_username" id="j_username" size="18" maxLength=50                                  tabindex="1"/></td>
                            </tr>
                            <tr valign="middle">
                                <td align="right" nowrap><b>Password:</b></td>
                                <td align="left"><input autocomplete="off" type="password" name="j_password" id="j_password"                                  size="18" maxLength=50 tabindex="2"/></td>
                            </tr>
                            <tr valign="middle">
                                <td align="right" nowrap>&nbsp;</td>
                                    <td colspan="2" align="left" class="texthdr" nowrap><input type="submit" name="submit"                                      value="Log In" class="mainSearchBtn"></td>
                            </tr>
                            </table>
                            </form>
                        </td>
                    </tr>
                </table>
                </td>
                </tr>
                </table>
                </center>
            </div>
        </div>
    </div>
</body>
<script>
$("j_username").focus();
</script>
</html>

Sample Custom Error Page

<html>
    <head>
    </head>
    <body>
    Authentication error.
    </body>
</html>

Sample Restore Session Page

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http:// www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title>You have another session open</title>
</head>
<body>
    <div id="horizon" style="margin-top:150px">
        <div id="content">
            <div id="contentText">
                <center>
                    <table border="0" width="500" cellpadding="0" cellspacing="0" style="margin: 20px;">
                        <tr valign="top">
                            <td class="bgcolor16" align="left" style="padding: 20px; border-bottom: 1px solid #CCCCCC;
                                line-height: 1.7em;">
                            <table border="0" cellpadding="3" cellspacing="0">
                            <tr valign="top">
                                <td style="padding: 8px 0px 0px 15px;">
                                    <span class="titlehdr5">You have another session open</span>
                                </td>
                        </tr>
                        <tr>
                            <td style="padding: 8px 0px 8px 15px;"><span style="padding:200px 0px 20px 0px;">You are either                             logged in at another location or did not log out of your previous session.<p>Do you want to recover                             the previous session and return to what you were working on, or start a new session (losing all                             previous work)?
                            </span></td>
                         </tr>
                         <tr>
                            <td align="center" class="texthdr">
                            <form name="mainForm" action="restoreSession.htm" method="post">
                            <input type="button" name="recover" value="Recover Session" class="mainSearchBtn"                             onclick="document.getElementById('restoreSession').value=true;document.mainForm.submit();"/>&nbsp;
                            <input type="button" name="new" value="New Session" class="mainSearchBtn"                              onclick="document.getElementById('restoreSession').value=false;document.mainForm.submit();"/>&nbsp;
                            <input type="hidden" id="restoreSession" name="restoreSession" value="true" />
                            </form>
                            </td>
                         </tr>
                         </table>
                         </td>
                        </tr>
                    </table>
                </center>
            </div>
        </div>
    </div>
</body>
</html>

Sample LDAP Configuration File

## This is a sample properties file for LDAP authentication. You can tailor it to your specific

## situation to work with the LDAP authentication mechanism included within TeamConnect. All

## un-commented properties in this file are required, though their values can be changed.

# Identification properties for this authentication component tc.displayName=LDAP Team Connect Authenticator

tc.uniqueId=LDAP

tc.isSSO=false

# Custom page mappings (omit any that do not apply)

#page.badCredentials=tryagain.html

#page.lockedAccount=giveup.html

#page.maximumLogins=sorry.html

#page.logout=goodbye.html

#page.sessionTimeout=missedyou.html

# LDAP configuration properties

#

# The URL of the LDAP server to be used ldap.host=10.1.2.48

ldap.port=389 ldap.root=dc=domain,dc=com

# DN of the user/administrator allowed to connect to the LDAP server ldap.userDn=cn=Manager,dc=domain,dc=com

# Password of the user/administrator ldap.password=secret

#

ldap.userDnPatterns=uid={0},ou=Department

#

ldap.groupDnPattern=ou=Department

#

ldap.groupRoleAttribute=cn