Skip to main content
Contact Support
  
Code42 Support

Integrating With LDAP For User Authentication

  1. Last updated
    13:02, 17 Apr 2017
  2. Save as PDF
Applies to:
  • CrashPlan PROe
This tutorial explains how to enable basic user authentication via LDAP for CrashPlan PROe. Additional advanced LDAP configuration options are available at User Management With LDAP Integration.

Before you begin

This article assumes you are familiar with basic LDAP principles.

An LDAP user account with read and search permissions is required for your master server to bind to your corporate directory service.

The following roles include the privileges to configure LDAP settings:

  • SYSADMIN role
  • Server Administrator role

Considerations

  • LDAP integration can cause existing CrashPlan PROe users to be deactivated in the following situation:
    1. A user account has been created in a given organization in your Code42 environment
    2. LDAP integration is activated for that organization
    3. A corresponding user account does not exist in the LDAP schema
  • Your enterprise servers do not store or cache the user password from LDAP in a local database.
  • CrashPlan PROe never writes any information to LDAP.
  • The enterprise server periodically synchronizes with the LDAP server(s) to run the Active, Org name, and Role scripts. The scripts determine if any changes need to be made based on the user's current attributes and group membership. A user that is removed from LDAP is automatically deactivated during synchronization. The default synchronization interval is once every 12 hours.

User creation with LDAP
LDAP integration helps to manage users, but it does not create them on its own. Create CrashPlan PROe users alongside LDAP integration in one of three ways:

Steps

Configure an LDAP server within CrashPlan PROe

On the master server:

  1. Sign into the administration console
  2. Go to Settings > Security > LDAP
  3. Click Add to add a new LDAP server
  4. Enter the following values:
    • Server Name: Name for your LDAP server
    • URL and search base: LDAP URL and Search Base for all queries
    • Bind DN and password (if required to search): Enter a fully-qualified distinguished account for Bind DN.
      • Bind DN example:
        uid=admin,ou=admins,dc=company,dc=com
      • Bind DN example for Active Directory:
        DOMAIN\exampleuser
    • Search Filter: The parameter specified before the ? is the attribute used to identify the user in CrashPlan PROe
      • Example LDAP filter to identify the user with UID:
        (&(objectclass=person)(uid=?))
      • Example LDAP filter to identify the user with E-mail:
        (&(objectclass=person)(email=?))
      • Example AD filter to identify the user with AD login name:
        (&(objectclass=person)(sAMAccountName=?))
    • Attribute Mapping: Choose the LDAP attributes to use for the Code42 environment user account fields:
      • Email
      • First name
      • Last name
        TIP: Use the username search field at the bottom to search or scroll through the list of users returned to check your settings.
  1. Click Save to save your settings.

You have now completed configuration of your LDAP server with CrashPlan PROe. Next, configure your enterprise server to utilize the configured LDAP server for user authentication.

Enable CrashPlan PROe to use LDAP authentication

Once your LDAP server is configured on your master server, you must enable your environment to use the LDAP server for authentication. You can enable LDAP authentication system-wide for all organizations inheriting settings from the top-level, or you can enable LDAP authentication only for specific organizations from the organization-level.

Disabling inheritance
If inheritance is disabled for an organization, that organization is not affected by changes to its parent organization.

To leverage LDAP authentication system-wide:

  1. From the administration console, navigate to Settings > Organization > Security
  2. Check the box next to LDAP server you configured previously
  3. Click Save to save your changes

To leverage LDAP authentication for an individual organization:

  1. From the administration console, navigate to Organizations
  2. Click name of the organization where you'd like LDAP authentication enabled
    This displays the organization's detail pane.
  3. From the action menu, choose Edit…
  4. Click the Security tab
  5. If checked, uncheck Inherit security settings from parent
  6. Check the box next to LDAP server you configured previously
  7. Click Save to save your changes