User management with LDAP integration

Capabilities at user creation

When users are created, the active, org name, and role name scripts are run. The scripts immediately affect the newly created users, placing them into the correct organization and granting them appropriate user roles based on their LDAP attributes and group membership.

Capabilities at LDAP sync

LDAP sync executes the active, org name and role name scripts each time it runs. By default, LDAP synchronization runs once every 12 hours, but this interval length can be configured.

At each LDAP sync, the scripts apply to all users. Certain scripts behave slightly differently at LDAP sync than at initial user creation. Behavior for each script is individually described below.

Active script examples

Deactivates users if the userAccountControl attribute within LDAP is set to disabled. 

function(entry) {
  return !(entry.userAccountControl & 0x2);
}

Another example script deactivates a user if the 'employeeType' attribute equals 'inactive', or activates a user if the 'employeeType' attribute equals any other value.

function(entry) { return entry.employeeType !="inactive" }

User deactivation and reactivation

When a user is deactivated, the user's devices are automatically deactivated. However, when a user is reactivated, the user's devices are not automatically reactivated. Devices can be reactivated in two ways:

• The reactivated user may sign in to the Code42 app on the deactivated device
• The administrator may activate the user's device from the administration console

In either case, the device's GUID remains the same. Data that was previously backed up is still available, if the data retention period has not expired. File selections and other settings also remain the same.

Org name script behavior at user creation

The org name script uses several parameters given to it, including the name of a target organization and an organization's registration key, to sort users into organizations.

Target organizations do not need to exist before the script runs. If a named target organization does not exist, the org name script creates an organization with that name as a child of the organization corresponding to the given registration key.

Any valid parsing can be performed on the DN (distinguished name) of the user's record with JavaScript, and in this way, LDAP OUs (organizational units) can map to Code42 environment organizations automatically.

Org name script behavior during LDAP sync

Unlike org name script behavior at user creation, organizations are not created by the org name script during regularly scheduled LDAP sync. This is because the org name script doesn't have the scope to determine your Code42 environment's organization structure in order to locate users and organizations.

LDAP OUs can still map automatically to your Code42 environment's organizations, but you will need to create the organizations in order for the org name script to sort your users during LDAP sync.

Org name script example

The org name script can place users into a Code42 environment organization based on the OU specified in each user's LDAP distinguished name. The script does the following:

1. Parse the user's distinguished name.
2. If the user is in the LDAP Staff OU, return the value “Staff” to place the user into the Code42 environment's Staff organization.
3. If the user is in the LDAP Students OU, return the value “Students” to place the user into the Code42 environment's Students organization.
4. If the user is in neither the Staff nor the Students OU, return the value “Default” to place the user in the Default organization.

function(entry) {
   var ou = entry.dn;
   if (ou != null){
       if ((ou.indexOf("Staff") >= 0 )){  
           return 'Staff';
       }
       else if ((ou.indexOf("Students") >= 0 )){
           return 'Students';  
       }
       else {
           return 'Default';  
       }  
   }
   else {
       return 'Default';  
   }  
}

Role name script example

This example analyzes an LDAP environment and grants Code42 for Enterprise user roles based on LDAP memberships.

1. Determine which LDAP groups the user is a member of.
2. Map the appropriate Code42 environment roles to the account:
   • If the user is a member of the Admins LDAP group, grant the SYSADMIN role.
   • If the user is a member of the Support LDAP group, grant the All Org Admin role.
   • If the user is a member of the Managers group, grant the All Org Manager role.
   • If the user is a member of the WorkstationAdmins group, grant the Server Administrator role.

function(entry) {
   var memberof = entry.memberOf;

   // Default user roles
   var myRoles=new Array("PROe User","Desktop User");

   // Loop over LDAP groups
   for (var x = 0; x < memberof.length; ++x) {
      if (memberof[x].indexOf("Admins") > -1) {
         myRoles.push("SYSADMIN");
      }
      if (memberof[x].indexOf("Support") > -1) {
         myRoles.push("All Org Admin");
      }
      if (memberof[x].indexOf("Managers") > -1) {
         myRoles.push("All Org Manager");
      }
      if (memberof[x].indexOf("WorkstationAdmins") > -1) {
         myRoles.push("Server Administrator");
      }
   }
   return myRoles;
}