.. /* * This file is part of the SavaPage project . * Copyright (c) 2026 Datraverse B.V. * Author: Rijk Ravestein. * * SPDX-FileCopyrightText: (c) 2020 Datraverse B.V. * SPDX-License-Identifier: CC-BY-SA-4.0 * * For more information, please contact Datraverse B.V. at this * address: info@datraverse.com */ .. _app-advanced-ldap-config-default: LDAP Configuration Defaults --------------------------- .. contents:: |RST_TABLE_OF_CONTENTS| :depth: 1 :local: When a particular LDAP server type is selected, SavaPage applies server type defaults to query the LDAP server. These defaults can be used as a starting point for customizing the LDAP searches or for supporting other server types. .. _app-advanced-ldap-config-openldap: OpenLDAP ~~~~~~~~ If the LDAP server is configured to support `OpenLDAP `__ based authentication, the following defaults are used. .. list-table:: OpenLDAP Default Settings :header-rows: 1 * - Configuration property - Default value * - ldap.schema.user-name-field - ``uid`` * - ldap.schema.user-full-name-field - ``cn`` * - ldap.schema.user-email-field - ``mail`` * - ldap.schema.user-department-field - ``departmentNumber`` * - ldap.schema.user-office-field - *This item is not set.* * - ldap.schema.user-name-search - ``(uid={0})`` * - ldap.schema.group-name-field - ``cn`` * - ldap.schema.group-full-name-field - ``displayName`` * - ldap.schema.group-member-field - ``member`` * - ldap.schema.group-search - ``(&(cn={0})(objectClass=groupOfNames))`` * - ldap.schema.posix-groups - ``N`` .. _app-advanced-ldap-config-freeipa: FreeIPA ~~~~~~~ The defaults for `FreeIPA `__ based authentication are identical to :ref:`OpenLDAP `. .. _app-advanced-ldap-config-open-directory: Apple Open Directory ~~~~~~~~~~~~~~~~~~~~ If the LDAP server is configured to support Apple Open Directory based authentication, the following defaults are used. .. list-table:: Apple Open Directory Default Settings :header-rows: 1 * - Configuration property - Default value * - ldap.schema.user-name-field - ``uid`` * - ldap.schema.user-full-name-field - ``cn`` * - ldap.schema.user-email-field - ``mail`` * - ldap.schema.user-department-field - ``departmentNumber`` * - ldap.schema.user-office-field - *This item is not set.* * - ldap.schema.user-name-search - ``(uid={0})`` * - ldap.schema.group-name-field - ``cn`` * - ldap.schema.group-full-name-field - ``displayName`` * - ldap.schema.group-member-field - ``memberUid`` * - ldap.schema.group-search - ``(memberUid={0})`` * - ldap.schema.posix-groups - ``Y`` .. _app-advanced-ldap-config-novell: Novell eDirectory Defaults ~~~~~~~~~~~~~~~~~~~~~~~~~~ If the LDAP server is a Novell eDirectory, the following defaults are used [1]_. .. list-table:: Apple Open Directory Default Settings :header-rows: 1 * - Configuration property - Default value * - ldap.schema.user-name-field - ``cn`` * - ldap.schema.user-full-name-field - ``fullName`` * - ldap.schema.user-email-field - ``mail`` * - ldap.schema.user-department-field - ``OU`` * - ldap.schema.user-office-field - ``l`` * - ldap.schema.user-name-search - ``(&(cn={0})(objectClass=person))`` * - ldap.schema.group-name-field - ``cn`` * - ldap.schema.group-full-name-field - ``fullName`` * - ldap.schema.group-member-field - ``member`` * - ldap.schema.group-search - ``(&(member={0})(objectClass=groupOfNames))`` * - ldap.schema.posix-groups - ``N`` .. [1] The list of standard Novell eDirectory user fields can be found on `NDK: Novell eDirectory Schema Reference `__. .. _app-advanced-ldap-config-windows: Microsoft Active Directory Defaults ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ If the LDAP server is a Microsoft Active Directory, the following defaults are used [2]_. .. list-table:: Microsoft Active Directory Default Settings :width: 100% :widths: 40 60 :header-rows: 1 * - Configuration property - Default value * - ldap.schema.user-name-field - ``sAMAccountName`` * - ldap.schema.user-full-name-field - ``displayName`` * - ldap.schema.user-email-field - ``mail`` * - ldap.schema.user-department-field - ``department`` * - ldap.schema.user-office-field - ``physicalDeliveryOfficeName`` * - ldap.schema.user-name-search - | ``(&(sAMAccountName={0})(objectCategory=person)(objectClass=user)(sAMAccountType=805306368){1})`` | | The extra ``{1}`` in the search is replaced with an optional filter | to fetch enabled users only. See "ldap.disabled-users.allow". * - ldap.schema.group-name-field - ``sAMAccountName`` * - ldap.schema.group-full-name-field - ``displayName`` * - ldap.schema.group-member-field - ``member`` * - ldap.schema.group-search - ``(&(sAMAccountName={0})(objectCategory=group))`` * - ldap.schema.posix-groups - ``N`` .. list-table:: Microsoft Active Directory Custom Settings :width: 100% :widths: 40 60 :header-rows: 1 * - Configuration property - Default value / Description * - ldap.disabled-users.allow - | ``N`` | | If ``Y``, then disabled users are accepted in user name | searches. If ``N``, they are ignored. * - ldap.schema.dn-field - | ``distinguishedName`` | | The LDAP field that contains the Distinguished Name (DN). * - ldap.schema.user-name-group-search - | ``(&(memberOf={0})(objectCategory=person)(objectClass=user)(sAMAccountType=805306368){1})`` | | This is the LDAP search to retrieve the users from a group. | | The ``{0}`` in the search is replaced with the DN of the user. | | The ``{1}`` in the search is replaced with an optional filter | to fetch enabled users only. See "ldap.disabled-users.allow". | | IMPORTANT: | The search must include the ``{0}`` and ``{1}`` value. * - ldap.schema.nested-group-search - | ``(&(memberOf={0})(objectCategory=group))`` | | This is the LDAP search to retrieve the nested groups | from a group. | | The ``{0}`` in the search is replaced with the DN of the group. | | IMPORTANT: | The search must include the ``{0}`` value. .. important:: Active Directory field names must be in the ``Ldap-Display-Name`` format. For example, if you want to use the *Employee-Number* field, then the field name entered should be *employeeNumber* as shown on the `Employee-Number attribute page `__. .. [2] The list of standard Active Directory user fields can be found on the Microsoft `Active Directory Schema `__ web site. .. _app-advanced-ldap-config-google-cloud: Google Cloud Directory ~~~~~~~~~~~~~~~~~~~~~~ The defaults for Google Cloud Directory based authentication are identical to :ref:`OpenLDAP `. If your organization is allowed to use LDAP for G Suite or Google Cloud Identity services, you can create a certificate that clients like SavaPage can use for user synchronization and authentication. To create the certificate, log in to `admin.google.com `__ as Super Admin and add an LDAP Client. Set your Access permissions, download the certificate zip file and save it in a secure location. Finally, switch the LDAP Service status ON in the Client Details. Note that it may take up to 24 hours for the LDAP Client to be active. The downloaded certificate zip file name contains its expiration date and time: we use ``Google_2022_10_27_37420.zip`` as an example. The zip contains the PEM formatted public certificate and private key file. .. code-block:: bash unzip Google_2022_10_27_37420.zip # Have a look at the certificate openssl x509 -in Google_2022_10_27_37420.crt -text -noout # Certificate: # Data: # Version: 3 (0x2) # Serial Number: 1563872646762 (0x16c1e12d66a) # Signature Algorithm: sha256WithRSAEncryption # Issuer: O=Google Inc., L=Mountain View, CN=LDAP Client, OU=GSuite, C=US, ... # Validity # Not Before: Oct 28 10:23:40 2019 GMT # Not After : Oct 27 10:23:40 2022 GMT # Subject: O=Google Inc., L=Mountain View, CN=LDAP Client, OU=GSuite, C=US, ... # Subject Public Key Info: # .... # Check the private key openssl rsa -in Google_2022_10_27_37420.key -check -noout # RSA key ok Use the certificate and private key to create the ``p12`` container needed by |PRODUCT_NAME|. In addition store the p12 export password in a separate file. Set strict read permissions on both files. .. code-block:: bash openssl pkcs12 -inkey Google_2022_10_27_37420.key -in Google_2022_10_27_37420.crt \ -export -out google-ldap-client-cert.p12 # Enter Export Password: # Verifying - Enter Export Password: sudo chown savapage:savapage google-ldap-client-cert.p12 sudo chmod 400 google-ldap-client-cert.p12 sudo mv google-ldap-client-cert.p12 /opt/savapage/server/data sudo su - savapage cd server/data # Create file with Export Password to unlock p12 file echo "password=export-password" > google-ldap-client-cert.pw chmod 400 google-ldap-client-cert.pw If ``google-ldap-client-cert.p12`` and ``google-ldap-client-cert.pw`` are present in ``/opt/savapage/server/data`` the Google Cloud Directory option will be available at :ref:`LDAP `.