OLAT - LDAP authentication module

Documentation of ldap package by Maurus Rohrer during GSoC


Use Cases:

Business Use Case 1:

The user enters the OLAT URL in his web browser and will be prompted to enter his user name and password. This Information is send to the configured LDAP server and checked on it's validation. If the user exits in LDAP and the password is the same as in LDAP, the user is redirected to his home environment in OLAT.



Business Use Case 2:

The OLAT administrator can start the admin-sync on a special side in OLAT. The admin-sync is gathering all information on the LDAP server and compares them with the one in the OLAT DB, all differences will be prompted to the administrator, if he confirms all changes will be written to the OLAT DB.



Business Use Case 3:

In a special configuration-file the administrator can specify the time an periods in which the cron-sync process should be executed. The cron-sync process is doing the same activities as the admin-sync, except that the changes don't need to be confirmed. All differences will be automatically written to the OLAT DB



Flow-Diagrams:

Detailed Flow-Diagram Use Case 1:



Detailed Flow-Diagram Use Case 2:





Detailed Flow-Diagram Use Case 3:





Class-Diagram:




Configuration:

To get the LDAPLogin Authentication Module running the olatextconfig.xml has to be configured. The different parameters are explained in the following table. The config file is saved under serviceconfig.org.olat.ldap._spring.olatextconfig.xml.

Property

Description

Notes

enableLDAPLogin

Enable or disable LDAP Module

true or false. If true LDAP Module will be loaded, otherwise the Module can't be used.

ldapURL

URL to LDAP Directory

If miss-configured, module will not be loaded.

ldapSystemDN

DN for system-user how can search throw hole directory.

If miss-configured, module will not be loaded.

ldapSystemPW

Password for ldap system-user

If miss-configured, module will not be loaded.

ldapBases

List of bases where to find users

If miss-configured, no users will be synced and create.

sslEnable

Enable if LDAP uses SSL

Keystore must contain certificate of LDAPs server. If not OLAT will not be starting.

trustStoreLocation

Path to keystore

If miss-configured, OLAT won't start.

trustStorePwd

Password for keystore

If miss-configured, OLAT won't start.

trustStoreType

Type of keystore

If miss-configured, OLAT won't start.

cacheLDAPPwdAsOLATPwdOnLogin

Saves LDAP Password in OLAT

When users log in via LDAP, the system can keep a copy of the password as encrypted hash in the database. This makes OLAT more independent from an offline LDAP server and users can use their LDAP password to use the WebDAV functionality. When setting to true (recommended), make sure you configured pwdchange=false in the olat.properties file.

convertExistingLocalUsersToLDAPUsers

Saves Olat Users as LDAP Users

When the system detects an LDAP user that does already exist in OLAT but is not marked as LDAP user, the OLAT user can be converted to an LDAP managed user. When enabling this feature you should make sure that you don't have a user 'administrator' in your ldapBases (not a problem but not recommended)

deleteRemovedLDAPUsersOnSync

Deleted users on Sync

Users that have been created vial LDAP sync but now can't be found on the LDAP anymore can be deleted automatically. If unsure, set to false and delete those users manually in the user management.

ldapSyncOnStartup

Start Sync on OLAT startup

Should users be created and synchronized automatically? If you set this configuration to false, the users will be generated on-the-fly when they log in

ldapSyncCronSync

Enable Cron Sync

Will execute cron-sync on defined schedule

ldapSyncCronSyncExpression

Define schedule

Typically unix-cron configuration

ldapUserObjectClass

LDAP Person Schema


reqAttrs

Attributes which must exist in LDAP

Define which user attributes are mandatory and how they are mapped to OLAT user properties. Note that OLAT requires at least the user properties userID and email. Those must be listed as mandatory. Others can be added as mandatory as well, but make sure the configuration here is consistent with the user properties configuration in the olat_userconfig.xml file. It is strongly recommended to add also lastName and firstName. See the olat_userconfig.xml file to learn which OLAT user properties are available. The maps require entries in the following syntax:
key: the LDAP attribute name
value: the OLAT user property name

userAttributeMapper

Attributes which will be saved in OLAT

Look at reqAttrs

staticUserProperties

Static User Properties

Specify static OLAT user properties that should be populated with a predefined value for each user. This is an optional feature, leaf the property empty if you don't need it. It can be use e.g. to distinguish LDAP users from local OLAT users in a course using the getUserProperty() condition.