LibraCyber Archiver fully integrates with Microsoft Exchange and Active Directory using LDAP for authenticating users.
Configure LDAP authentication
- Navigate to your LibraCyber Archiver and select Settings > Authentication > LDAP Configuration
- Select the tenant (if not selected) and click the green button with the plus icon
- Give a name to the connection
- Enter the hostname (or IP) of the LDAP server
- Choose appropriate Query (Default:
mail={username}) - Choose the LDAP port (389 for LDAP and 636 for LDAPs)
- Choose the appropriate encryption (if needed)
- Choose USER as the default role (note: this is the default role assigned to the users authenticating from LDAP)
- Flag the use for authentication checkbox (else it would not be used for authenticating users)
- The sync groups flag is not needed, you can leave it un-flagged
- Enter the username and password of the user used to access LDAP
- Validate the connection
- Enter the Base DN of the users
- Leave all the other field with the default value
- Optionally click on "Test Authentication" and enter valid credentials of an existing users in order to test the authentication process
- Save it
Note: By default, LDAP Query operates as:
mail={username}however, to exclude unnecessary Microsoft Exchange service mailbox entries, configure it as follows:
(&(mail={username})(objectClass=user)(!(mail=healthmailbox*))(!(mail=systemmailbox*))(!(mail=discoverysearchmailbox*))(!(mail=migration*))(!(mail=federatedemail*)))
Check the users matched by the LDAP configuration
- Navigate to your LibraCyber Archiver and select Settings > Authentication > LDAP Configuration
- Select the tenant (if not selected)
- Click the gray button with the users icon next to the edit button to check the users loaded by the selected LDAP configuration
Check the authentication
Note: the configuration you created before allow the users to login using their own primary email address (mario.rossi@domain.com). To make it working you need to add the domain in the tenant domains configuration (in this case you need to add domain.com to the tenant domain list).
- Logout from the admin user (using the button in the top right of the page)
- Login using the primary email address of the account you want to try and his password.