KACE as a Service 7.1 - Administrator Guide

Importing users from an LDAP server

Importing users from an LDAP server

You can import user information from LDAP servers to create user accounts on the K1000 appliance. This provides administrators, such as Service Desk staff, with a richer set of data to use when working with users.

There are two ways to import user information:

NOTE: User information is overwritten each time users are imported to the appliance. Password information, however, is not imported. Users must enter their passwords each time they log in to the Administrator Console or User Console.

Import user information manually

Import user information manually

You can import user information manually by specifying criteria to identify the users you want to import.

NOTE: Use the LDAP Browser to specify the Search Base DN and Search Filter. See Use the LDAP Browser.

Option	Description
Server	The IP address or the hostname of the LDAP server. If the IP address is not valid, the appliance waits to timeout, resulting in login delays during LDAP authentication.   NOTE: To connect through SSL, use an IP address or hostname. For example: ldaps://hostname. If you have a non-standard SSL certificate installed on your LDAP server, such as an internally-signed certificate or a chain certificate that is not from a major certificate provider such as VeriSign, contact Quest Support at https://support.quest.com/contact-support for assistance.
Port	The LDAP port number, which is usually 389 (LDAP) or 636 (secure LDAP).
Base DN	The criteria used to search for accounts. This criteria specifies a location or container in the LDAP or Active Directory structure, and the criteria should include all the users that you want to authenticate. Enter the most specific combination of OUs, DCs, or CNs that match your criteria, ranging from left (most specific) to right (most general). For example, this path leads to the container with users that you need to authenticate: OU=end_users,DC=company,DC=com.   NOTE: Use the LDAP Browser to specify the Search Base DN and Search Filter. Use the LDAP Browser.
Advanced Search	The search filter. For example: (&(sAMAccountName=KBOX_USERNAME)(memberOf=CN=financial,DC=example,DC=com))
Login	The credentials of the account the K1000 uses to log in to the LDAP server to read accounts. For example: LDAP Login:CN=service_account,CN=Users, DC=company,DC=com. If no username is provided, an anonymous bind is attempted. Each LDAP Label can connect to a different LDAP or Active Directory server.
Password	The password of the account the K1000 uses to log in to the LDAP server.

Option	Description
Attributes to retrieve	Specify the LDAP attributes to retrieve. For example: sAMAccountName, objectguid, mail, memberof, displayname, sn, cn, userPrincipalName, name, description, manager The LDAP attributes specified in this field can be mapped to K1000 User attributes on the next page. If this field is blank, the appliance retrieves all LDAP attributes. Leaving this field blank increases the time required to import attributes and is not recommended.   IMPORTANT: To retrieve the manager object associated with the user, you must add the manager attribute to the list, and to specify this mapping in a later step.
Label Attribute	Enter a label attribute. For example: memberof. This setting returns a list of groups this user is a member of. The union of all the label attributes forms the list of labels you can import. If the search filter contains both the label names and user names, the label attribute is not required.
Label Prefix	Enter the label prefix. For example: ldap_ The label prefix is a string that is added to the beginning of all the labels.
Binary Attributes	Enter the binary attributes. For example: objectsid. Binary attributes indicates which attributes should be treated as binary for purposes of storage.
Maximum Number of Rows	Enter the maximum number of rows to retrieve. This limits the result set that is returned in the next step.
Debug Output	Select the check box to view the debug output.

Option	Description
Ldap Uid	The identifier for the user. Recommended value: objectguid.
User Name	The name of the user. Recommended value: name.
Email	The email address for the user. Recommended value: mail.
Manager	The manager of the user. This mapping is mandatory only if you want to retrieve the manager information. Recommended value: manager.   IMPORTANT: To retrieve the manager object associated with the user, you must also add the manager attribute to the Attributes to retrieve box.

The Users page appears, and the imported users appear on the list. The imported users can access the features of the Administrator Console, User Console based on the role to which they are assigned.

Import user information according to a schedule

Import user information according to a schedule

To keep user data current, schedule regular user data imports from your LDAP server.

2.	Select LDAP Authentication, then click the Schedule button next to the server name in the list of servers to schedule a user import: .

The following Read Only Administrator Server Details are displayed:

Option	Description
Server	The IP address or the hostname of the LDAP server. If the IP address is not valid, the appliance waits to timeout, resulting in login delays during LDAP authentication.   NOTE: To connect through SSL, use an IP address or hostname. For example: ldaps://hostname. If you have a non-standard SSL certificate installed on your LDAP server, such as an internally-signed certificate or a chain certificate that is not from a major certificate provider such as VeriSign, contact Quest Support at https://support.quest.com/contact-support for assistance.
Port	The LDAP port number, which is usually 389 (LDAP) or 636 (secure LDAP).
Base DN	The criteria used to search for accounts. This criteria specifies a location or container in the LDAP or Active Directory structure, and the criteria should include all the users that you want to authenticate. Enter the most specific combination of OUs, DCs, or CNs that match your criteria, ranging from left (most specific) to right (most general). For example, this path leads to the container with users that you need to authenticate: OU=end_users,DC=company,DC=com.   NOTE: Use the LDAP Browser to specify the Search Base DN and Search Filter. Use the LDAP Browser.
Advanced Search	The search filter. For example: (&(sAMAccountName=KBOX_USERNAME)(memberOf=CN=financial,DC=example,DC=com))
Login	The credentials of the account the K1000 uses to log in to the LDAP server to read accounts. For example: LDAP Login:CN=service_account,CN=Users, DC=company,DC=com. If no username is provided, an anonymous bind is attempted. Each LDAP Label can connect to a different LDAP or Active Directory server.
Password	The password of the account the K1000 uses to log in to the LDAP server.

Option	Description
Attributes to retrieve	Specify the LDAP attributes to retrieve. For example: sAMAccountName, objectguid, mail, memberof, displayname, sn, cn, userPrincipalName, name, description, manager The LDAP attributes specified in this field can be mapped to K1000 User attributes on the next page. If this field is blank, the appliance retrieves all LDAP attributes. Leaving this field blank increases the time required to import attributes and is not recommended.   IMPORTANT: To retrieve the manager object associated with the user, you must add the manager attribute to the list, and to specify this mapping in a later step.
Label Attribute	Enter a label attribute. For example: memberof. This setting returns a list of groups this user is a member of. The union of all the label attributes forms the list of labels you can import. If the search filter contains both the label names and user names, the label attribute is not required.
Label Prefix	Enter the label prefix. For example: ldap_ The label prefix is a string that is added to the beginning of all the labels.
Binary Attributes	Enter the binary attributes. For example: objectsid. Binary attributes indicates which attributes should be treated as binary for purposes of storage.
Maximum Number of Rows	Enter the maximum number of rows to retrieve. This limits the result set that is returned in the next step.
Debug Output	Select the check box to view the debug output.

4.	In the Email Recipients section, click the Edit button to enter the recipient’s email address .

Option	Description
Ldap Uid	The identifier for the user. Recommended value: objectguid.
User Name	The name of the user. Recommended value: name.
Email	The email address for the user. Recommended value: mail.
Manager	The manager of the user. This mapping is mandatory only if you want to retrieve the manager information. Recommended value: manager.   IMPORTANT: To retrieve the manager object associated with the user, you must also add the manager attribute to the Attributes to retrieve box.

About single sign on (SSO)

About single sign on (SSO)

Single sign on enables users who are logged on to the domain, or authenticated through a third-party, to access the K1000 Administrator Console and User Console without having to re-enter their credentials on the K1000 login page.

You can use either Active Directory or Quest Identity Brokerfor single sign on. You cannot enable both single sign on methods simultaneously on the same appliance.

Single sign on is available for:

NOTE: Quest recommends that you access the Administrator Console using the web server name rather than the IP address. The web server name can be found on the Network Settings page. See Changing appliance network settings.