{"id":259,"date":"2015-04-09T19:11:11","date_gmt":"2015-04-09T19:11:11","guid":{"rendered":"https:\/\/www.jumpcloud.com\/engineering-blog\/?p=259"},"modified":"2023-06-14T13:49:56","modified_gmt":"2023-06-14T17:49:56","slug":"how-to-connect-your-application-to-ldap","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/how-to-connect-your-application-to-ldap","title":{"rendered":"How to Connect Your Application to LDAP"},"content":{"rendered":"\n
JumpCloud\u2019s Directory-as-a-Service solution is based in large part on LDAP<\/a>. A core part of the solution is to enable devices and applications to authenticate via LDAP. The way our solution works is that admins place their users in the JumpCloud directory. Our directory enables those credentials that have been created in the JumpCloud directory to be leveraged via a number of different protocols such LDAP, SAML, SSH, and others. The goal of Directory-as-a-Service is to enable a wide variety of devices and applications to be authenticated and authorized.<\/p>\n\n\n\n For this particular blog post, we\u2019ll focus on the ability for applications to authenticate to our LDAP server<\/a>. The process generally works as follows:<\/p>\n\n\n\n The core of this process is how to configure your application to communicate with JumpCloud. This can be a tricky configuration setup if you don\u2019t know the various parameters to pass to LDAP. We\u2019ll review some of those parameters here, but, of course, if you need help connecting your application to JumpCloud, just drop us a note \u2013 we\u2019d be happy to help.<\/p>\n\n\n\n We\u2019ve already blogged about connecting a number of common applications to JumpCloud. These include: Git LDAP authentication<\/a>, Okta, OpenVPN, Meraki, Jira, Confluence, and MySQL LDAP<\/a> configurations among others. These are good examples and will provide you with a variety of different approaches to connecting your application to LDAP.<\/p>\n\n\n\n For your specific application, we\u2019ll go over some of the key parameters to consider:<\/p>\n\n\n\n Field names for applications include: Bind DN, Manager DN, Password Because LDAP is a directory database, and not simply a user store, it\u2019s a bit more complicated to specify your username than with a simple user store. LDAP is a hierarchical database, which means that you need to provide a full path to your user object. A username in isolation won\u2019t be enough information for LDAP to identify which user object you\u2019re talking about.<\/p>\n\n\n\n In JumpCloud you specify a user in the following format:<\/p>\n\n\n\n uid=<username>,ou=Users,o=<organizationId>,dc=jumpcloud,dc=com<\/span><\/p>\n\n\n\n for example:<\/p>\n\n\n\n uid=jdoe,ou=Users,o=309AF39093AFBBDCF902093015672309,dc=jumpcloud,dc=com<\/span><\/p>\n\n\n\n The directory structure is read from right to left:<\/p>\n\n\n\n The string above, \u201cuid=<username>,ou=Users,o=<organizationId>,dc=jumpcloud,dc=com\u201d is called a \u201cDN\u201d or distinguished name, because it uniquely identifies an object in the LDAP directory structure.<\/p>\n\n\n\n So when you bind to JumpCloud\u2019s LDAP directory, instead of username and password, you really provide a DN and password for authentication. Some applications only try to bind to LDAP to perform authentication, while others bind and then search. Those that bind and search require an LDAP Binding User Service Account for the DN, while the others do not.<\/p>\n\n\n\n Field names for applications include: Search Base, Group Name, User Name, Base DN<\/p>\n\n\n\n Assuming that a bind has taken place with an LDAP Binding User Service Account, let\u2019s consider the three types of objects that you can search:<\/p>\n\n\n\n Because LDAP\u2019s directory is freeform, many applications have to ask you for the path where they can find each of the above types of objects (normally they only ask about Users and Groups, however). This is referred to as the Search Base, the place where the client application expects to search and find that type of object. Some applications expect a single search base (which is similar to how Active Directory is structured), while others know that User and Group objects may be in different directory locations.<\/p>\n\n\n\n Your answer to this question for either Users or Groups is the same:<\/p>\n\n\n\n ou=Users,o=<organizationId>,dc=jumpcloud,dc=com<\/span><\/p>\n\n\n\n This is because that DN includes all three object types. That value is what you\u2019ll use for your search base, or base DN value.<\/p>\n\n\n\n When an application requests user unique identifier, you\u2019ll generally want to use:<\/p>\n\n\n\n uid<\/span><\/p>\n\n\n\n A uid value, followed by the rest of the search base, will uniquely identify any user object in your JumpCloud LDAP directory, for example:<\/p>\n\n\n\n uid=jdoe,ou=Users,o=<organizationId>,dc=jumpcloud,dc=com,<\/span><\/p>\n\n\n\n When an application requests group unique identifier, you\u2019ll generally use:<\/p>\n\n\n\n cn<\/span><\/p>\n\n\n\n \u201cCN\u201d stands for Common Name, and is the way a JumpCloud group is identified. For example:<\/p>\n\n\n\n cn=WiFi Users,ou=Users,o=<organizationId>,dc=jumpcloud,dc=com<\/span><\/p>\n\n\n\n This will uniquely identify the \u201cWiFi Users\u201d group in your JumpCloud LDAP directory.<\/p>\n\n\n\n Because it is up to the client application to bring meaning to the LDAP directory, the client chooses which groups are meaningful to it. For example, if you\u2019re running OpenVPN and using JumpCloud to authenticate user logins, you may only want to allow members of the \u201cChicago OpenVPN Users\u201d group to be able to login using the VPN.<\/p>\n\n\n\n To do that, you\u2019ll need to filter your set of users down to only those that are members of \u201cChicago OpenVPN Users\u201d, and to do that, we\u2019ll need to use a filter.<\/p>\n\n\n\n In some cases, an application will allow you to specify a group DN and will be able to query all the members of that group. In these cases, you\u2019ll simply provide the DN of your group, such as:<\/p>\n\n\n\n cn=Chicago OpenVPN Users,ou=Users,o=<organizationId>,dc=jumpcloud,dc=com<\/span><\/p>\n\n\n\n The application can then query all the member attributes of the \u201cChicago OpenVPN Users\u201d group, which will look like:<\/p>\n\n\n\n member: uid=jdoe,ou=Users,o=<organizationId>,dc=jumpcloud,dc=com The application can then use this list to determine whether to allow the to login, or not.<\/p>\n\n\n\n Since the JumpCloud LDAP service supports the memberOf overlay, each user also contains the list of all the groups of which it is a member.<\/p>\n\n\n\n In this case, the search is a bit different, you\u2019ll specify a filter that returns only the members of a particular group. A filter for our OpenVPN group would look like:<\/p>\n\n\n\n (&(objectType=inetOrgPerson)(memberOf=cn=Chicago OpenVPN Users,ou=Users,o=<organizationId>,dc=jumpcloud,dc=com))<\/span><\/p>\n\n\n\n This filter says, return me all the objects with an objectType of inetOrgPerson (a User), that are also a member of the \u201cChicago OpenVPN Users\u201d group.<\/p>\n\n\n\n Filters can be very complex, but this filter is one that is very common. You can also build filters that search for only a specific group. For example:<\/p>\n\n\n\n (&(objectClass=groupOfNames)(cn=Admins))<\/span><\/p>\n\n\n\n This filter will return only group objects named \u201cAdmins\u201d. For more details around using filters, please see our knowledge base article<\/a> on the topic.<\/p>\n\n\n\n These are the most common settings that you\u2019ll need when connecting your application to JumpCloud\u2019s hosted LDAP solution. Of course, there may be more nuances depending upon the application, but this should get you started. If you need further help, drop our support line<\/a> a note and they would be happy to help.<\/strong><\/p>\n\n\n\n\n
\n
Binding<\/b><\/h2>\n\n\n\n
\nIn LDAP, authenticating your user is called \u201cbinding\u201d to the directory. With a bind, you provide your username and password to the LDAP server. There are three potential outcomes: <\/strong><\/strong><\/p>\n\n\n\n\n
\n
Searching<\/b><\/h2>\n\n\n\n
\n
Filtering<\/b><\/h2>\n\n\n\n
Groups-First Filter<\/b><\/h3>\n\n\n\n
\nmember: uid=pembroke,ou=Users,o=<organizationId>,dc=jumpcloud,dc=com
\nmember: uid=jody,ou=Users,o=<organizationId>,dc=jumpcloud,dc=com<\/span><\/p>\n\n\n\nMemberOf Filter<\/b><\/h3>\n\n\n\n
Other Filters<\/b><\/h3>\n\n\n\n
Need More Help?<\/b><\/h2>\n\n\n\n