LibraCyber Email Archiver supports LDAP configuration. For each configuration you can see the caching status (more information at Directory service users cache) and the list of users.

Configuration

When configuring an LDAP configuration you have to provide:

name: a descriptive label
host: the hostname or the IP address of the LDAP server
port: the port of the ldap server (the default port is 389)
encryption: the encryption of the LDAP connection (no encryption, TLS, SSL)
default role: the default role to assign to the users (you can choose any role you configured on the Archiver)
use for authentication: check this option if you want the users to be able to authenticate on the Archiver
sync groups: check to synchronize groups
username and password: credentials for LDAP binding

The others parameters on the right column are the typical LDAP parameters. The alias field is field used for fetching the user aliases (default to proxyAddresses for Exchange-based environments) and the mail field is the field used for fetching user primary email address.

NOTE: Username value is supposed to be an email address that WILL NOT change in the future. If the user will change user will lose all the archived folder structure. If the value is not a valid email address the authentication will not work.

Once you inserted all the required information you can both validate the connection and test the authentication. By clicking on the Test authentication button you will be prompted for an username and password to test if authentication works as expected.

NOTE: If the authentication isn't working check that you have correctly configured the domains list in the tenant configuration page.

NOTE: on Active Directory environments we suggest to restrict the LDAP query to skip internal AD users. You can use the following query to select only valid users:

 (&(mail={username})(objectClass=user)(!(mail=healthmailbox*))(!(mail=systemmailbox*))(!(mail=discoverysearchmailbox*))(!(mail=migration*))(!(mail=federatedemail*)))

NOTE: To include delegated users in Exchange 2016, the distinguishedName parameter must be included in the LDAP query. You can use the following query to select only valid users an delegated users associated:

 (&(|(distinguishedName={username})(mail={username}))(objectClass=user)(!(mail=healthmailbox*))(!(mail=systemmailbox*))(!(mail=discoverysearchmailbox*))(!(mail=migration*))(!(mail=federatedemail*)))

NOTE: LDAPS supports only TLS 1.1 or TLS 1.2. Windows Server 2003 which uses TLS 1.0 / SSL 3 is not supported.

Configuration

Related articles